MongoDB Server: Use-after-free in SBE $locf window accumulator
Summary
A use-after-free flaw in the SBE window accumulator used by certain $setWindowFields aggregation pipelines can lead to a heap out-of-bounds read and a crash of the mongod server. An authenticated user with readWrite privileges on a database can trigger it by crafting a specific aggregation pipeline. The main impact is denial of service, with a limited possibility of disclosing adjacent heap memory.
Affected
- MongoDB Server 9.0.0 to before 9.0.7
- MongoDB Server 8.3.0 to before 8.3.16
- Default configuration: unaffected
- Status of 8.0.x and 7.0.x: unknown, not confirmed by the vendor
Fixed in
- MongoDB Server 9.0.7
- MongoDB Server 8.3.16
Workaround
Unknown. No vendor workaround found.
- Restrict readWrite roles to required users and applications
- Audit which accounts can run aggregation pipelines
Exploitation
- No evidence of exploitation in the wild found
- No public proof of concept found
- Not listed in CISA KEV at the time of research
Our recommendation
- Update MongoDB Server to 9.0.7 or 8.3.16 (or later) and check whether 8.0.x or 7.0.x deployments are affected by reading the MongoDB advisory SERVER-135180
- Limit readWrite privileges to necessary accounts and review which applications can run aggregation pipelines
- Ensure MongoDB is not reachable from untrusted networks
- Monitor mongod for unexpected crashes and re-check exploitation status in the coming days
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CVE Record CVE-2026-120803 www.cve.org
- MongoDB Jira SERVER-135180 jira.mongodb.org
- Strix CVE-2026-120803 www.strix.ai
- SecurityOnline MongoDB fixed builds securityonline.info
- MongoDB Security Advisory AV26-1122 (Canadian Centre for Cyber Security) www.cyber.gc.ca
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 07:10.
Original description (NVD)
A use-after-free issue exists in MongoDB’s SBE (Slot-Based Execution) implementation of a window function accumulator used by certain $setWindowFields aggregation pipelines. Under specific conditions, the accumulator can retain a dangling pointer to memory that has since been freed. When this stale pointer is later dereferenced during serialization of the carried-forward value, it can result in a heap out-of-bounds read that may expose adjacent heap contents and crash the mongod server. An authenticated user with readWrite privileges on a database can trigger this issue by crafting a specific aggregation pipeline.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.