MongoDB Server: use-after-free in query memory tracking crashes or corrupts the server process

Impact

An authenticated user with nothing more than read privileges can drive the query execution memory tracking subsystem into writing to freed heap memory using ordinary database commands. The stated outcome is a crash of the server process, with potential memory corruption beyond that. Where MongoDB backs a cluster control plane - job metadata, tenant records, model or dataset catalogues - a read-only account held by any tenant-facing service becomes an availability lever over scheduling and admission, and a crashed primary forces a replica set election. The record scores it 7.2 with high integrity and availability impact and no confidentiality loss; no user interaction is needed.

Who can reach it

Any authenticated MongoDB user holding read privileges on the server, reachable over the network wherever the database listens. No elevated role and no user interaction required.

What to do

Upgrade to the fixed MongoDB Server release tracked in SERVER-130907; the record does not name the fixed versions, so take them from the MongoDB advisory for your major branch. Applying it is a rolling restart of replica set or shard members rather than a node reboot. Until then, audit which accounts hold read access and cut off untrusted or tenant-facing credentials, since read privilege is the entire precondition.

References

Related entries

• ATEN Unizon fleet management platform: Unizon is ATEN's centralized manager for its KVM and PDU fleet. The restoreDBCVE-2026-9777 · ATEN Unizon fleet management platformHigh
• CephFS (via OpenStack Manila native driver): A Manila user can request access for an existing CephFS identity and getCVE-2020-27781 · CephFS (via OpenStack Manila native driver)High
• Linux iSCSI: Unprivileged user can craft Netlink messages to scsi_transport_iscsiCVE-2021-27364 · Linux iSCSIHigh
• linuxptp / ptp4l (transparent clock on little-endian): A crafted PTP packet against ptp4l running as a transparentCVE-2021-3571 · linuxptp / ptp4l (transparent clock on little-endian)High
• Schneider Electric Data Center Expert (versions prior to v7.9.0) - Java deserialization: Unsafe deserialization of dataCVE-2022-32521 · Schneider Electric Data Center Expert (versions prior to v7.9.0) - Java deserializationHigh
• IBM Storage Scale Container Native Storage Access (namespace boundary): A local attacker can initiate connections fromCVE-2022-41737 · IBM Storage Scale Container Native Storage Access (namespace boundary)High