Buffer overflow in MongoDB
CVE-2026-13072
When compute mode is enabled on a standalone mongod instance, insufficient validation of externally sourced BSON data during aggregation pipeline processing can result in memory corruption, potentially leading to process termination or other unintended behavior. This configuration is non-default and requires explicit enablement at startup.
Vulnerability class: Buffer Overflow
EPSS: 0.004 (33.6th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 8.1 (High). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Mongodb
- Mongodb Server — versions 7.0, 8.0, 8.2.0
Weakness classification (CWE)
References
- cna@mongodb.com (Patch, Vendor Advisory)
Frequently asked questions
- What is CVE-2026-13072?
- CVE-2026-13072 is a high-severity vulnerability in MongoDB, classified under Heap-based Buffer Overflow. CVSS score: 8.1/10. Published 2026-07-22.
- How severe is CVE-2026-13072?
- High severity. CVSS v3 base score is 8.1 out of 10.