Privileged Write Use-After-Free in MongoDB TimeSeries Bucket Lifecycle
CVE-2026-18692 Published on August 11, 2026
Use-After-Free in MongoDB Timeseries Bucket Handling Leads to Denial of Service and Potential Remote Code Execution
An issue in MongoDB Server's handling of timeseries bucket lifecycle could allow an authenticated user with write privileges to cause an internal reference to be used after the underlying memory has been freed. Subsequent operations could then result in a server crash or, potentially, execution of unintended code.
Vulnerability Analysis
CVE-2026-18692 is exploitable with network access, and requires small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity and availability.
Weakness Type
What is a Dangling pointer Vulnerability?
Referencing memory after it has been freed can cause a program to crash, use unexpected values, or execute code.
CVE-2026-18692 has been classified to as a Dangling pointer vulnerability or weakness.
Products Associated with CVE-2026-18692
Want to know whenever a new CVE is published for MongoDB? stack.watch will email you.
Affected Versions
MongoDB Server:- Version 8.3.0 and below 8.3.8 is affected.