Riskcovery

CVE-2026-8053

FlatBSON Duplicate Field Index Drift

State
Published
Severity
8.7 High
Published
May 12, 2026
Updated
May 14, 2026
Reserved
May 6, 2026

Read the record on cve.org

Description

An issue in MongoDB Server's time-series collection implementation allows an authenticated user with database write privileges to trigger an out-of-bounds memory write in the mongod process. The issue results from an inconsistency in the internal field-name-to-index mapping within the time-series bucket catalog. Under certain conditions this can result in arbitrary code execution.

This issue impacts MongoDB Server v5.0 versions prior to 5.0.33, v6.0 versions prior to 6.0.28, v7.0 versions prior to 7.0.34, v8.0 versions prior to 8.0.23, v8.2 versions prior to 8.2.9 and v8.3 versions prior to 8.3.2.

Scores

CVSSScoreVectorSource
4.08.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:Nmongodb
3.18.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hmongodb

Weaknesses

Affected Products

ProductVersions
MongoDB ServerMongoDB, Inc.
  • 5.0 to before 5.0.33Affected
  • 6.0 to before 6.0.28Affected
  • 7.0 to before 7.0.34Affected
  • 8.0 to before 8.0.23Affected
  • 8.2 to before 8.2.9Affected
  • 8.3 to before 8.3.2Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.