CVE-2026-18700

MEDIUM

Use-After-Free in MongoDB Geospatial Validation Leads to Denial of Service

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2026-18700 has a selected CVSS score of 6.0 (medium).

Description

An issue in MongoDB Server's geospatial validation could allow an authenticated user with write privileges to cause an internal reference to be used after the underlying memory has been freed, through concurrent operations against a collection using a certain type of validator. This could result in a server crash, leading to a denial of service.

Description source: CVE List

Exploitation context

CISA SSVC decision

ExploitationNone
AutomatableNo
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Aug 11, 2026 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

MongoDB Server

Browse MongoDB / MongoDB Server

Default status: unaffected

CVE List8.3.0 to < 8.3.8affected
8.0 to < 8.0.29affected
7.0 to < 7.0.40affected

References

2