CVE-2026-9753 - Server crash via malformed binary diff passed to $_internalApplyOplogUpdate.

Back Back to CVE browser

HIGH

Server crash via malformed binary diff passed to $_internalApplyOplogUpdate.

Published Jun 9, 2026

7.2

HIGH

CVSS 4.0

EPSS 0.52%

Description

The $_internalApplyOplogUpdate aggregation pipeline stage can be used to execute a document diff containing a malformed binary diff to return memory out-of-bounds or crash the server. $_internalApplyOplogUpdate can be executed by any authenticated user with access to the aggregate command.

Affected products

Vendor MongoDB Product MongoDB Server Default
unaffected
- Version
  7.0.0
  Status
  affected
  Constraints
  <7.0.35
- Version
  8.0.0
  Status
  affected
  Constraints
  <8.0.24
- Version
  8.2.0
  Status
  affected
  Constraints
  <8.2.10
- Version
  8.3.0
  Status
  affected
  Constraints
  <8.3.3