Vulnerability · Published Mar 17, 2026 · Assigned by mongodb
CVE-2026-4358Memory safety issues in slot-based execution hash table spill
Medium 6.4
In plain English
A medium-severity double free in MongoDB Server from MongoDB Inc. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 30% of all known vulnerabilities).
Severity (CVSS 3.1)6.4Medium
Exploit odds (30 days)0.4%top 69.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
A specially crafted aggregation query with $lookup by an authenticated user with write privileges can cause a double-free or use-after-free memory issue in the slot-based execution (SBE) engine when an in-memory hash table is spilled to disk.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| MongoDB Inc | MongoDB Server | 8.2 – before 8.2.68.0 – before 8.0.207.0 – before 7.0.31 |
Weakness: CWE-415 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H