Loading vulnerability…
Use-after-free in MongoDB SBE window-function accumulator
CVE-2026-120803 is a use-after-free vulnerability in MongoDB Server's Slot-Based Execution (SBE) implementation of a window-function accumulator used by certain $setWindowFields aggregation pipelines. Under specific conditions, the accumulator retains a dangling pointer to freed memory. Dereferencing this pointer when serializing a carried-forward value can cause a heap out-of-bounds read, potentially disclosing adjacent heap contents and crashing the mongod server. An authenticated user with readWrite privileges on a database can trigger the vulnerability through a crafted aggregation pipeline. Affected versions are MongoDB Server 8.3.0 through versions before 8.3.16 and 9.0.0 through versions before 9.0.7.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can disclose adjacent server heap contents and cause a mongod server crash, resulting in information disclosure and denial of service. Arbitrary code execution and privilege escalation are not established.
Patch, then assume compromise.
Upgrade affected MongoDB Server 8.3 installations to version 8.3.16 or later and affected 9.0 installations to version 9.0.7 or later within their respective release branches.
No public exploits tracked yet. Mallory keeps watching.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.