Log in Start free

Vulnerability · Published Jun 12, 2026 · Assigned by mongodb

CVE-2026-11933Post-authentication use-after-free in server-side JavaScript BSON-to-array conversion

High 8.8

In plain English

A high-severity out-of-bounds write in MongoDB from MongoDB. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 33% of all known vulnerabilities).

Severity (CVSS 3.1)8.8High
Exploit odds (30 days)0.4%top 67.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

A use-after-free vulnerability exists in MongoDB Server's server-side JavaScript engine when converting BSON documents to JavaScript arrays. An authenticated user with read privileges who is able to run server-side JavaScript (for example, via $where or $function) can cause the server to access memory that has already been freed. This may result in disclosure of information from the mongod process memory or a denial of service through a server crash.

Affected products (as reported)

VendorProductVersions
MongoDB MongoDB 8.3.0 – through 8.3.38.2.0 – through 8.2.108.0.0 – through 8.0.257.0.0 – through 7.0.366.0 – through 6.0.285.0 – through 5.0.334.4.0 – through 4.4.30

Weakness: CWE-787 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References