CVE-2026-13077

Name of the Vulnerable Software and Affected Versions The product name cannot be determined (affected versions not specified)

Description A missing bounds check in the BSON CodeWScope element accessors enables an authenticated user to trigger an out-of-bounds heap read through a crafted aggregation pipeline. By generating malformed BSONColumn data containing a CodeWScope element, an attacker can bypass wire-level BSON validation. During the decompression of the forged element, an unchecked size value is used in pointer arithmetic, which may lead to a server crash or the disclosure of adjacent heap memory contents.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.