CVE-2026-82071 PUBLISHED

Insufficient Validation of Storage Engine Configuration Options in MongoDB Server Leads to Out-of-Bounds Write

Assigner: mongodb
Reserved: 27.08.2026 Published: 08.09.2026 Updated: 08.09.2026

Insufficient validation of storage engine configuration options in MongoDB Server allows an authenticated user with write privileges to supply crafted parameters during collection creation that override internal storage metadata. This results in an out-of-bounds memory write in the server process, causing a denial of service via server crash, with potential for further impact including arbitrary code execution.

Metrics

CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N
CVSS Score: 7.2

Product Status

Vendor MongoDB
Product MongoDB Server
Versions Default: unaffected
  • affected from 8.3.0 to 8.3.9 (excl.)

References

Problem Types

  • CWE-787: Out-of-bounds Write CWE