---
cve: "CVE-2026-82066"
severity: "MEDIUM"
cvss: 5.3
epss: "0.3%"
vendor: "MONGODB"
kev: false
exploited: false
published: "2026-09-08 17:18:35"
tags: [cve, security, medium]
source: tsecurity.de CVE-Dossier
exported: "2026-09-21T02:15:17+02:00"
---

# CVE-2026-82066

> 5.3 MEDIUM

## Beschreibung

A heap out-of-bounds read security issue exists in the query planning component of MongoDB Server. An authenticated user with database read and write privileges can trigger the security issue through crafted query operations, causing the server to read memory beyond allocated buffer boundaries. The revealed memory contents may be partially observable through diagnostic query statistics output.

## CVSS-Vektor

```
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
```

| Metrik | Wert | Bewertung |
|---|---|---|
| AV Angriffsvektor | Netzwerk | bad |
| AC Komplexität | Gering | bad |
| PR Privilegien | Gering | warn |
| UI Interaktion | Keine | bad |

## Patch verfügbar (OSV)

- 6df23543fc9e7ee456ff05ed726b22865ea753e7 (Commit)
- 11c3ed7c274d5fb7149e498323bd0377c3a2876e (Commit)

## Referenzen

- <https://jira.mongodb.org/browse/SERVER-131562>

---
_Exportiert aus dem [tsecurity.de CVE-Dossier](https://tsecurity.de/cve?cve=CVE-2026-82066) · Datenquellen: EUVD (ENISA), NVD, OSV, CISA KEV, FIRST EPSS, Exploit-DB, BSI BITS_