MongoDB Server: Use-after-free read in SBE query engine
Summary
MongoDB Server's SBE (Slot-Based Execution) query engine can free a value that is still in use when an aggregation pipeline with $unwind runs on time-series collections. An authenticated user with a crafted pipeline can read recycled server heap memory in query results or crash the server. The flaw only applies when a non-default SBE-related server parameter is enabled.
Affected
- MongoDB Server 9.0.0 before 9.0.7
- MongoDB Server 8.3.0 before 8.3.16
- MongoDB Server 8.0.0 before 8.0.37
- Default configuration: not affected
- Branches older than 8.0 are not listed in the CVE record.
Fixed in
- MongoDB Server 9.0.7
- MongoDB Server 8.3.16
- MongoDB Server 8.0.37
Workaround
- Unknown. No workaround is documented in the sources.
- Check mongod for non-default SBE-related parameters and disable them if they are not required. The sources do not name the parameter.
Exploitation
- No known exploitation at the time of writing.
- No CISA KEV entry or public proof of concept found. The CVE was published on 10 November 2026, so this is a weak signal.
Our recommendation
- Inventory all MongoDB Server instances and their versions.
- Check the configuration for non-default SBE parameters and disable them where not needed.
- Upgrade to the fixed version for your branch. Apply the whole 9.0.7 / 8.3.16 / 8.0.37 release, since it was published alongside more serious MongoDB CVEs.
- Confirm MongoDB is not reachable from the internet and review accounts with read access.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CVE record CVE-2026-120809 www.cve.org
- MongoDB Jira SERVER-132279 jira.mongodb.org
- MongoDB 9.0.7 release (community forum) www.mongodb.com
- MongoDB security update notice (community forum) www.mongodb.com
- MongoDB alerts www.mongodb.com
- Strix CVE-2026-120809 (third-party) www.strix.ai
- ThreatInt CVE-2026-120809 (third-party) cve.threatint.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 14:18.
Original description (NVD)
A use-after-free read issue exists in MongoDB’s SBE (Slot-Based Execution) engine when processing aggregation pipelines with $unwind on time-series collections. An internal error in state-preservation logic can cause a value still referenced by downstream stages to have its underlying memory freed prematurely. An authenticated user can craft an aggregation pipeline under specific conditions to trigger this condition, potentially reading recycled server heap memory in query results or crashing the server. This issue is only triggerable when a non-default server parameter related to the SBE engine is enabled.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.