# CVE-2026-120809: MongoDB use-after-free read in SBE aggregation pipeline

Source: https://junglewise.ai/threats/cve-2026-120809-a-use-after-free-read-issue-exists-in-mongodb-s-sbe-slot-based  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-10. Updated: 2026-11-10  
License: CC BY 4.0 with a link back

CVE-2026-120809 · Severity: medium · CVSS 6.8 · Published 2026-11-10

MongoDB's query engine contains a use-after-free vulnerability when processing certain aggregation pipeline queries on time-series collections. An authenticated attacker can craft a malicious query to trigger this flaw, potentially reading sensitive data from the server's memory or causing the database to crash. The vulnerability only affects systems with a non-default server parameter enabled.

Technologies: [MongoDB Server](https://junglewise.ai/threats/technologies/mongodb-server). Vendors: [MongoDB](https://junglewise.ai/threats/vendors/mongodb).

## Quick answers

**Is CVE-2026-120809 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-120809 being exploited in the wild.

**How severe is CVE-2026-120809?** Medium severity, with a CVSS score of 6.8, published 10 November 2026.

**Which products and versions are affected?** MongoDB Server 8.0.x before 8.0.37, 8.2.x before 8.2.x (unspecified), 8.3.x before 8.3.16, 9.0.x before 9.0.7.

**Is there a fix for CVE-2026-120809?** Yes: fixed in MongoDB Server 8.0.37, 8.3.16, 9.0.7. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-120809 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-120809?** Check whether you run MongoDB Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in MongoDB Server 8.0.37, 8.3.16, 9.0.7

## Technical details

A use-after-free condition exists in MongoDB's SBE (Slot-Based Execution) engine's BlockToRow stage when handling stage yielding during aggregation pipelines with $unwind on time-series collections. The underlying block is partially saved but a slot accessor's referenced value is not properly preserved, causing premature memory deallocation. An authenticated user can craft an aggregation pipeline to trigger this, reading recycled heap memory or crashing the server; exploitation requires a non-default server parameter to be enabled.

## Affected products

- MongoDB MongoDB Server 8.0.x before 8.0.37, 8.2.x before 8.2.x (unspecified), 8.3.x before 8.3.16, 9.0.x before 9.0.7

## Timeline

- 2026-11-10: disclosed
- 2026-11-10: patched

## References

- [https://jira.mongodb.org/browse/SERVER-132279](https://jira.mongodb.org/browse/SERVER-132279)

## Related threats

- [MongoDB Server authorization bypass in aggregation pipeline](https://junglewise.ai/threats/cve-2026-120825-an-authorization-weakness-in-the-aggregation-framework-of)
- [MongoDB Server use-after-free in time-series bucket validation](https://junglewise.ai/threats/cve-2026-120824-a-use-after-free-in-the-time-series-collection-component-of)
- [MongoDB Server missing authorization check in aggregation framework](https://junglewise.ai/threats/cve-2026-120823-a-missing-authorization-check-in-the-aggregation-framework-of)
- [MongoDB Server authorization bypass in applyOps](https://junglewise.ai/threats/cve-2026-120822-mongodb-server-may-omit-an-authorization-check-on-the-resource)
- [MongoDB Server use-after-free in aggregation framework](https://junglewise.ai/threats/cve-2026-120821-a-use-after-free-in-the-aggregation-framework-of-mongodb-server)