CVE-2026-18693
Out-of-Bounds Read/Write in MongoDB Timeseries Bucket Handling Leads to Denial of Service and Potential Memory Disclosure
CVSS Score
7.6
EPSS Score
0.0%
EPSS Percentile
0th
An issue in MongoDB Server's handling of timeseries collections could allow an authenticated user with write privileges to cause an internal data structure to become inconsistent through certain document insertions. A subsequent insert into the affected bucket could then result in the server accessing memory outside its intended bounds, potentially causing a server crash (denial of service), exposure of limited memory contents, or memory corruption.
| CWE | CWE-787 |
| Vendor | mongodb |
| Product | mongodb server |
| Ecosystems | |
| Industries | Technology |
| Published | Aug 11, 2026 |
Stay Ahead of the Next One
Get instant alerts for mongodb mongodb server
Be the first to know when new high vulnerabilities affecting mongodb mongodb server are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
Low
Availability
High
Affected Versions
MongoDB / MongoDB Server
8.3.0 < 8.3.8 8.0 < 8.0.29 7.0 < 7.0.40