CVE WatchNov 10, 2026

CVE-2026-120818

A use-after-free weakness in MongoDB Server's server-side JavaScript support for aggregation may allow a stale reference to previously freed

CVSS

7.1

High

EPSS

—

KEV

—

Exploit Today

—

0-100

Published: Nov 10, 2026 · Last modified: Nov 10, 2026 · CWE-416

EPSS · 30d

Not enough EPSS history yet.

Technical description

A use-after-free weakness in MongoDB Server's server-side JavaScript support for aggregation may allow a stale reference to previously freed process memory to be read and returned. An authenticated user with minimal or no assigned roles can trigger this condition over the normal network protocol by submitting a single crafted aggregation request, with no additional privileges or non-default configuration. Successful triggering this issue may result in adjacent process memory contents being returned, including data that undermines memory-layout randomization, and may in some cases affect server availability.

Official references

jira.mongodb.orghttps://jira.mongodb.org/browse/SERVER-135727

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2026-126064—

—

———Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.5, the CRuby native extension can leave Ruby wrappers pointing to freed memory when Nokogiri::XML::Node#[]= or Nokogiri::XML::Node#lang= replaces an existing attribute value after code has accessed the attribute's child nodes. Replacing the value frees native child nodes while their wrappers remain reachable, and later use of those wrappers can cause an invalid read or process segfault. JRuby is not affected. This issue is fixed in version 1.19.5.9h CVE-2026-1208248.8 HIG

—

———A use-after-free in the time-series collection component of MongoDB Server can occur when the server validates a time-series bucket document during a write. The condition can be caused by an authenticated user with privileges to write bucket documents directly, and may result in the server terminating unexpectedly or, under certain conditions, arbitrary code execution in the context of the server process.8h CVE-2026-1208216.5 MED

—

———A use-after-free in the aggregation framework of MongoDB Server can occur when certain expressions are evaluated in an aggregation sub-pipeline. The condition can be caused by an authenticated user with read privileges, and may result in the server terminating unexpectedly.8h CVE-2026-1208194.3 MED

—

———A memory-management flaw in the server-side JavaScript execution component of MongoDB Server can allow an authenticated user holding only read privileges to cause the server to access memory that has already been released. By submitting a specially crafted database command that runs user-supplied JavaScript, the user can cause a bounded amount of adjacent process memory to be returned in the command's result. This results in the user obtaining information they are not authorized to access. Integrity and availability are not affected.8h CVE-2026-1183839.0 CRI

—

———A use-after-free in the replication component of MongoDB Server can occur when a newly elected replica set primary completes catch-up. The condition can be caused by requests that do not require authentication, and may result in the server terminating unexpectedly or, under certain conditions, arbitrary code execution in the context of the server process. Replica set members are affected, including the shard and config server replica set members of sharded clusters; standalone mongod instances are not.8h CVE-2026-1175467.8 HIG

—

———Photoshop Desktop is affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.9h