CVE-2026-9753 — Server crash via malformed binary diff passed to $_internalApplyOplogUpdate.

CVE-2026-9753

Server crash via malformed binary diff passed to $_internalApplyOplogUpdate. PUBLISHED

Description (CNA)

The $_internalApplyOplogUpdate aggregation pipeline stage can be used to execute a document diff containing a malformed binary diff to return memory out-of-bounds or crash the server. $_internalApplyOplogUpdate can be executed by any authenticated user with access to the aggregate command.

Affected (CNA)

Vendor / product	Versions
MongoDB / MongoDB Server	affected 8.3.0 before 8.3.3; affected 8.2.0 before 8.2.10; affected 8.0.0 before 8.0.24; affected 7.0.0 before 7.0.35

CWE

CWE-1287

References

https://jira.mongodb.org/browse/SERVER-124959

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.