CVE-2026-82057
A security issue was discovered in MongoDB where an authenticated user with readWrite privileges could crash the mongod server process. By specifying a custom WiredTiger storage configuration option with an incompatible value during collection creation, a user could cause a type confusion in the storage engine layer. When documents were subsequently read from the misconfigured collection, the resulting mismatch in expected data format led to corrupted memory interpretation and a server crash. The crafted collection configuration persists across restarts, requiring manual operator intervention to remediate.
Scoring
- Severity
- HIGH
- CVSS base score
- 7.1
- CVSS vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
- CWE
- CWE-843
- Published
- 2026-09-08
- Last modified
- 2026-09-08
Affected products
- MongoDB MongoDB Server
Weakness type
Related vulnerabilities
- CVE-2026-87528 — Type confusion in Rust in Google Chrome on on Windows prior to 153.0.8010.36 allowed a remote...
- CVE-2026-87636 — Type confusion in XML in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to...
- CVE-2026-87612 — Type confusion in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute...
- CVE-2026-87564 — Type confusion in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to read...
- CVE-2026-80161 — Acrobat Reader | Access of Resource Using Incompatible Type ('Type Confusion') (CWE-843)
- CVE-2026-81401 — Microsoft Excel Information Disclosure Vulnerability
- CVE-2026-72938 — Microsoft Office PowerPoint Information Disclosure Vulnerability
- CVE-2026-69679 — Windows DHCP Server Denial of Service Vulnerability