Executive brief
MongoDB Server is a widely-used database platform that stores and manages structured data for applications. An authenticated database user with write permissions can trigger a bug in how MongoDB handles timeseries collections by inserting specially-crafted documents, causing the server to access memory beyond its allocated bounds. This can crash the database (causing service outage), expose sensitive data from memory, or corrupt database state.
Technical details
The vulnerability is a heap buffer overflow in MongoDB's FlatBSON data structure handling within timeseries collections. An authenticated attacker with write privileges can insert duplicate field names into a FlatBSON store, leaving it malformed and corrupting its internal consistency. A subsequent insert into the affected bucket triggers out-of-bounds memory access, potentially causing a denial of service (server crash), limited memory disclosure, or memory corruption. The attack requires prior authentication with write access to a timeseries collection. Patches are available in versions 7.0.40, 8.0.29, 8.2.13, 8.3.8, 9.0.0-rc2, and 9.1.0-rc0.
Affected products
- MongoDB Server before 7.0.40, 8.0.29, 8.2.13, 8.3.8, 9.0.0-rc2, 9.1.0-rc0
Timeline
- 2026-08-11: disclosed: CVE-2026-18693 published
- 2026-08-11: patched: Fixes available in versions 7.0.40, 8.0.29, 8.2.13, 8.3.8, 9.0.0-rc2, 9.1.0-rc0