# CVE-2026-82061: MongoDB Server use-after-free in query execution memory tracking

Source: https://junglewise.ai/threats/cve-2026-82061-mongodb-server-use-after-free-in-query-execution-memory-tracking  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-08. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-82061 · Severity: high · CVSS 8.1 · Published 2026-09-08

MongoDB Server contains a use-after-free vulnerability in its query execution memory management subsystem. An authenticated database user with read privileges can crash the server or corrupt memory by executing a specific sequence of database commands involving Exchange pipelines with UnionWith and memory-tracking stages. This could lead to service unavailability and potential data integrity issues.

Technologies: [MongoDB](https://junglewise.ai/threats/technologies/mongodb). Vendors: [MongoDB](https://junglewise.ai/threats/vendors/mongodb).

## Quick answers

**Is CVE-2026-82061 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-82061 being exploited in the wild.

**How severe is CVE-2026-82061?** High severity, with a CVSS score of 8.1, published 8 September 2026.

**Which products and versions are affected?** MongoDB Server before 8.3.9, before 9.0.0-rc2, before 9.1.0-rc0.

**Is there a fix for CVE-2026-82061?** A patch was published on 2026-09-08: Fixed in versions 8.3.9, 9.0.0-rc2, 9.1.0-rc0, 9.1.0-rc1024 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-82061 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-82061?** Check whether you run MongoDB. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A use-after-free vulnerability exists in MongoDB's OperationMemoryUsageTracker when processing Exchange pipelines containing UnionWith operators with memory-tracking stages like setWindowFields. The vulnerability occurs when a consumer other than consumer-0 wins the race to construct the UnionWith subpipeline first; this creates a memory tracker stored on the client cursor that becomes a dangling pointer after cursor destruction. Subsequent consumers executing the exchange pipeline trigger a use-after-free when accessing the freed memory tracker. The attack requires authentication with read privileges and involves standard database commands; no user interaction is needed beyond query execution. MongoDB has patched this issue in versions 8.3.9, 9.0.0-rc2, 9.1.0-rc0, and 9.1.0-rc1024.

## Affected products

- MongoDB Server before 8.3.9, before 9.0.0-rc2, before 9.1.0-rc0

## Timeline

- 2026-09-08: disclosed
- 2026-09-08: patched: Fixed in versions 8.3.9, 9.0.0-rc2, 9.1.0-rc0, 9.1.0-rc1024

## References

- [https://jira.mongodb.org/browse/SERVER-130907](https://jira.mongodb.org/browse/SERVER-130907)

## Related threats

- [MongoDB replica-set denial of service via unreclaimed wait records](https://junglewise.ai/threats/cve-2026-120828-a-replica-set-database-server-node-does-not-limit-or-reclaim)
- [MongoDB privilege escalation via change stream showSystemEvents](https://junglewise.ai/threats/cve-2026-120816-a-user-with-basic-read-tier-database-privileges-can-use-an)
- [MongoDB macOS TLS certificate validation bypass for IPv6](https://junglewise.ai/threats/cve-2026-120808-an-issue-exists-in-mongodb-s-macos-tls-client-implementation)
- [MongoDB resource leak in SSPI Kerberos authentication handler](https://junglewise.ai/threats/cve-2026-120804-a-flaw-exists-in-the-server-side-sspi-kerberos-authentication)
- [MongoDB use-after-free in SBE window function accumulator](https://junglewise.ai/threats/cve-2026-120803-a-use-after-free-issue-exists-in-mongodb-s-sbe-slot-based)