{"id":"CVE-2026-120803","kind":"vulnerability","aliases":["CVE-2026-120803"],"related":[],"title":"MongoDB: window function use-after-free leaks heap memory and can crash the server","description":"A use-after-free issue exists in MongoDB’s SBE (Slot-Based Execution) implementation of a window function accumulator used by certain $setWindowFields aggregation pipelines. Under specific conditions, the accumulator can retain a dangling pointer to memory that has since been freed. When this stale pointer is later dereferenced during serialization of the carried-forward value, it can result in a heap out-of-bounds read that may expose adjacent heap contents and crash the mongod server. An authenticated user with readWrite privileges on a database can trigger this issue by crafting a specific aggregation pipeline.","summary":"A use-after-free in MongoDB's Slot-Based Execution window function accumulator, used by certain $setWindowFields pipelines, lets a stale pointer be read during serialization. An attacker can read adjacent heap contents and crash the mongod server.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"MongoDB","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["database","mongodb","runtime","self-hosted"],"not_affected_if":["auth-required","managed-hosting"],"how_to_check":"- Check the running version with `mongod --version` and compare it against the fixed versions in the MongoDB advisory\n- Look for pipelines that use `$setWindowFields` if you have application logs or query audit data","fix":null,"status":"open","published_at":"2026-11-10T20:18:50+00:00","first_seen_at":"2026-11-10T20:46:01+00:00","triaged_at":"2026-11-10T20:47:53+00:00","updated_at":"2026-11-10T21:03:58+00:00","category":"runtime","confidence":0.3,"triage":{"at":"2026-11-10T20:47:53Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"MongoDB: window function use-after-free leaks heap memory and can crash the server","impact":"medium","summary":"A use-after-free in MongoDB's Slot-Based Execution window function accumulator, used by certain $setWindowFields pipelines, lets a stale pointer be read during serialization. An attacker can read adjacent heap contents and crash the mongod server.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["mongodb","self-hosted","database"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Server memory leaks to a user and mongod crashes","analyst_note":"Get affected version ranges and fixed versions from the MongoDB advisory for CVE-2026-120803; the NVD entry gives none.","how_to_check":"- Check the running version with `mongod --version` and compare it against the fixed versions in the MongoDB advisory\n- Look for pipelines that use `$setWindowFields` if you have application logs or query audit data\n- unknown for affected version ranges: the sources do not list them","plain_action":"","product_name":"MongoDB","needs_analyst":true,"not_affected_if":["auth-required","managed-hosting"],"who_is_affected":"Only deployments where users with readWrite privileges on a database can submit aggregation pipelines to mongod, since the flaw is reached by crafting a specific $setWindowFields pipeline. Deployments that restrict who can run aggregations or that do not expose the database to untrusted users face lower risk. The sources do not list the affected version ranges.","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000769,"input_tokens":4654,"output_tokens":607,"severity_before":"high"},"analyst_status":"done","analyst_note":"Get affected version ranges and fixed versions from the MongoDB advisory for CVE-2026-120803; the NVD entry gives none.","search":"'-120803':18A,21A '-2026':17A,20A 'accumul':43B,89C,100C 'adjac':61B,142C 'aggreg':94C,167C 'attack':58B 'authent':151C 'base':39B,82C 'bound':137C 'carri':125C 'carried-forward':124C 'certain':46B,92C 'condit':98C 'content':63B,144C 'craft':164C 'crash':13A,65B,146C 'cve':16A,19A 'dangl':104C 'databas':23B,158C 'dereferenc':119C 'execut':40B,83C 'exist':75C 'expos':141C 'forward':126C 'free':7A,33B,73C 'freed':112C 'function':3A,42B,88C 'heap':9A,62B,133C,143C 'host':28B 'implement':84C 'issu':74C,162C 'later':118C 'leak':8A 'let':49B 'may':140C 'memori':10A,107C 'mongod':67B,148C 'mongodb':1A,22A,24B,35B,77C 'out-of-bound':134C 'pipelin':48B,95C,168C 'pointer':52B,105C,116C 'privileg':155C 'read':54B,60B,138C 'readwrit':154C 'result':130C 'retain':102C 'runtim':25B 'sbe':79C 'self':27B 'self-host':26B 'serial':56B,121C 'server':15A,68B,149C 'setwindowfield':47B,93C 'sinc':110C 'slot':38B,81C 'slot-bas':37B,80C 'specif':97C,166C 'stale':51B,115C 'trigger':160C 'use':5A,31B,44B,71C,90C 'use-after-fre':4A,30B,70C 'user':152C 'valu':127C 'window':2A,41B,87C","nicknames":[],"mitigations":[],"who_affected":"Only deployments where users with readWrite privileges on a database can submit aggregation pipelines to mongod, since the flaw is reached by crafting a specific $setWindowFields pipeline. Deployments that restrict who can run aggregations or that do not expose the database to untrusted users face lower risk. The sources do not list the affected version ranges.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":["mongodb"],"ptokens":["mongodb"],"labels":["database","high","mongodb","runtime","selfhosted","vendor"],"campaign_type":null,"search_a":"'-120803':18A,21A '-2026':17A,20A 'crash':13A 'cve':16A,19A 'free':7A 'function':3A 'heap':9A 'leak':8A 'memori':10A 'mongodb':1A,22A 'server':15A 'use':5A 'use-after-fre':4A 'window':2A","search_b":"'accumul':43B 'adjac':61B 'attack':58B 'base':39B 'certain':46B 'content':63B 'crash':65B 'databas':23B 'execut':40B 'free':33B 'function':42B 'heap':62B 'host':28B 'let':49B 'mongod':67B 'mongodb':24B,35B 'pipelin':48B 'pointer':52B 'read':54B,60B 'runtim':25B 'self':27B 'self-host':26B 'serial':56B 'server':68B 'setwindowfield':47B 'slot':38B 'slot-bas':37B 'stale':51B 'use':31B,44B 'use-after-fre':30B 'window':41B","search_c":"'accumul':89C,100C 'adjac':142C 'aggreg':94C,167C 'authent':151C 'base':82C 'bound':137C 'carri':125C 'carried-forward':124C 'certain':92C 'condit':98C 'content':144C 'craft':164C 'crash':146C 'dangl':104C 'databas':158C 'dereferenc':119C 'execut':83C 'exist':75C 'expos':141C 'forward':126C 'free':73C 'freed':112C 'function':88C 'heap':133C,143C 'implement':84C 'issu':74C,162C 'later':118C 'may':140C 'memori':107C 'mongod':148C 'mongodb':77C 'out-of-bound':134C 'pipelin':95C,168C 'pointer':105C,116C 'privileg':155C 'read':138C 'readwrit':154C 'result':130C 'retain':102C 'sbe':79C 'serial':121C 'server':149C 'setwindowfield':93C 'sinc':110C 'slot':81C 'slot-bas':80C 'specif':97C,166C 'stale':115C 'trigger':160C 'use':71C,90C 'use-after-fre':70C 'user':152C 'valu':127C 'window':87C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T20:18:50+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@mongodb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120803","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120803","severity":null,"published_at":"2026-11-10T20:18:50+00:00","modified_at":"2026-11-10T20:18:50+00:00","first_seen_at":"2026-11-10T20:46:01+00:00","fetched_at":"2026-11-10T20:46:01+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-120803:2744","url":null,"severity":null,"published_at":"2026-11-10T21:03:58+00:00","modified_at":"2026-11-10T21:03:58+00:00","first_seen_at":"2026-11-10T21:03:58+00:00","fetched_at":"2026-11-10T21:03:58+00:00","note":"Searched NVD, cve.org, MongoDB alerts page, release notes 8.0/8.3 and web: no MongoDB advisory or Jira entry for this CVE is reachable (NVD/cve.org pages empty). Affected and fixed versions remain unknown; nothing verified. Settle by finding the MongoDB SERVER-xxxxx Jira/CVE record (cna mongodb) or the release notes naming CVE-2026-120803. Interim check: mongod --version and whether  is used; upgrade to latest patch of your release line."}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}