What is CVE-2025-11979?

CVE-2025-11979 is a medium-severity vulnerability in MongoDB, classified under Use After Free. CVSS score: 5.3/10. Published 2025-10-20.

How severe is CVE-2025-11979?

Medium severity. CVSS v3 base score is 5.3 out of 10.

Use After Free in MongoDB

CVE-2025-11979

An authorized user may crash the MongoDB server by causing buffer over-read. This can be done by issuing a DDL operation while queries are being issued, under some conditions. This issue affects MongoDB Server v7.0 versions prior to 7.0.25, MongoDB Server v8.0 versions prior to 8.0.15, and MongoDB Server version 8.2.0.

Vulnerability class: Use-After-Free

EPSS: 0.003 (16.7th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 5.3 (Medium). Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H.

Affected products

Mongodb
Mongodb Inc. Server — versions 8.2.0, 8.0.0, 7.0.0

Weakness classification (CWE)

CWE-416 — Use After Free

References

cna@mongodb.com (Vendor Advisory)

Frequently asked questions

What is CVE-2025-11979?: CVE-2025-11979 is a medium-severity vulnerability in MongoDB, classified under Use After Free. CVSS score: 5.3/10. Published 2025-10-20.
How severe is CVE-2025-11979?: Medium severity. CVSS v3 base score is 5.3 out of 10.