Buffer overflow in MongoDB
CVE-2026-8053
An issue in MongoDB Server's time-series collection implementation allows an authenticated user with database write privileges to trigger an out-of-bounds memory write in the mongod process. The issue results from an inconsistency in the internal field-name-to-index mapping within the time-series bucket catalog. Under certain conditions this can result in arbitrary code execution. This issue impacts MongoDB Server v5.0 versions prior to 5.0.33, v6.0 versions prior to 6.0.28, v7.0 versions prior to 7.0.34, v8.0 versions prior to 8.0.23, v8.2 versions prior to 8.2.9 and v8.3 versions prior to 8.3.2.
Vulnerability class: Buffer Overflow
EPSS: 0.006 (45.0th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Mongodb
- Mongodb, Inc. Mongodb Server — versions 5.0, 6.0, 7.0
Weakness classification (CWE)
Public proof-of-concept exploits
References
- cna@mongodb.com (issue-tracking, Patch, Vendor Advisory)
Frequently asked questions
- What is CVE-2026-8053?
- CVE-2026-8053 is a high-severity vulnerability in MongoDB, classified under Out-of-bounds Write. CVSS score: 8.8/10. Published 2026-05-13.
- How severe is CVE-2026-8053?
- High severity. CVSS v3 base score is 8.8 out of 10.
- Is CVE-2026-8053 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.