# CVE-2026-82066: Heap Out-of-Bounds Read in MongoDB Server Query Planning Component

> CVE-2026-82066: Heap Out-of-Bounds Read in MongoDB Server Query Planning Component. CVSS 4.3 (CVSS 3.1).

Canonical: https://rewindex.com/cve/CVE-2026-82066
Last updated: 2026-09-16T20:37:42Z

- Published: 2026-09-08 16:12 UTC · Updated: 2026-09-16 20:37 UTC · Assigner: mongodb
- CVSS: 4.3 (CVSS 3.1) · Severity: Medium · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
- EPSS: 0.39%, 33th percentile (scored 2026-10-25)
- CISA KEV: no
- CWE: CWE-125

## Description

A heap out-of-bounds read security issue exists in the query planning component of MongoDB Server. An authenticated user with database read and write privileges can trigger the security issue through crafted query operations, causing the server to read memory beyond allocated buffer boundaries. The revealed memory contents may be partially observable through diagnostic query statistics output.

## Affected vendors and products

- MongoDB: MongoDB Server

## Tracked companies

- [MongoDB Atlas](https://rewindex.com/company/mongodb-atlas.md)

## References

- [CVE record on cve.org](https://www.cve.org/CVERecord?id=CVE-2026-82066)
- [NVD entry](https://nvd.nist.gov/vuln/detail/CVE-2026-82066)
- [https://jira.mongodb.org/browse/SERVER-131562](https://jira.mongodb.org/browse/SERVER-131562)

---

_Sources: CVE records from the CVE Program (cve.org). CVE® is a registered trademark of The MITRE Corporation. (https://www.cve.org/) This product uses data from the NVD API but is not endorsed or certified by the NVD. (https://nvd.nist.gov/) Known Exploited Vulnerabilities catalog from CISA. (https://www.cisa.gov/known-exploited-vulnerabilities-catalog) EPSS scores from FIRST (Exploit Prediction Scoring System). (https://www.first.org/epss/)_


---
Canonical: https://rewindex.com/cve/CVE-2026-82066 · Markdown: https://rewindex.com/cve/CVE-2026-82066.md · JSON: https://rewindex.com/api/v1/cves/CVE-2026-82066 · Data licensed CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) · Generated 2026-10-26T02:11:27.290Z