CVE-2026-9753 — Server crash via malformed binary diff passed to $_internalApplyOplogUpdate.
The $_internalApplyOplogUpdate aggregation pipeline stage can be used to execute a document diff containing a malformed binary diff to return memory out-of-bounds or crash the s…
Published: 2026-06-09 · CVSS: 7.2 · CVSS 4.0
The $_internalApplyOplogUpdate aggregation pipeline stage can be used to execute a document diff containing a malformed binary diff to return memory out-of-bounds or crash the server. $_internalApplyOplogUpdate can be executed by any authenticated user with access to the aggregate command.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7