CVE-2026-118383 is a critical use-after-free vulnerability in the replication component of MongoDB Server. It occurs when a newly elected replica set primary completes catch-up. The flaw can be triggered by unauthenticated requests and may cause the server to crash or, under certain conditions, allow arbitrary code execution. This affects replica set members, including shard and config server replica sets in sharded clusters, but not standalone mongod instances.