CVE-2026-9753
EUVD-2026-3585209.06.2026, 23:17
The $_internalApplyOplogUpdate aggregation pipeline stage can be used to execute a document diff containing a malformed binary diff to return memory out-of-bounds or crash the server. $_internalApplyOplogUpdate can be executed by any authenticated user with access to the aggregate command.Enginsight
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
| Vendor | Product | Version | Source |
|---|---|---|---|
| mongodb | mongodb | 8.3.0 ≤ 𝑥 < 8.3.3 | CNA |
| mongodb | mongodb | 8.2.0 ≤ 𝑥 < 8.2.10 | CNA |
| mongodb | mongodb | 8.0.0 ≤ 𝑥 < 8.0.24 | CNA |
| mongodb | mongodb | 7.0.0 ≤ 𝑥 < 7.0.35 | CNA |
Common Weakness Enumeration