CVE-2026-9753: Server crash via malformed binary diff passed to $_internalApplyOplogUpdate.

Synopsis

An out-of-bounds memory read and server crash vulnerability exists in MongoDB Server's $_internalApplyOplogUpdate aggregation pipeline stage. The flaw is reachable over the network by any authenticated user with access to the aggregate command, requiring no elevated privileges. Successful exploitation reads memory contents outside intended bounds or crashes the mongod process entirely. Patched-image rebuilds at versions 7.0.35, 8.0.24, 8.2.10, and 8.3.3 are available on HarborGuard for environments running affected versions.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the MongoDB service over the network to submit the malformed aggregation pipeline request.

• AuthenticationRequired

  Any low-privilege account with access to the aggregate command is sufficient; no admin or elevated role is needed.

• Victim interactionNot required

  No victim action is needed; the attacker submits the malformed request directly without any user interaction.

• Attack complexityDetail

  The exploit is reliable and condition-free, requiring no race conditions, special memory layout, or environmental dependencies.

Blast Radius

• Reads memory contents outside the intended buffer, potentially exposing in-process data such as documents, connection state, or credentials held in the mongod process memory.
• Crashes the mongod server process, taking down all databases and connections served by that instance.
• A repeated crash loop denies service to all applications and users depending on the affected MongoDB node.
• Replica set members or standalone instances are equally affected, so a targeted crash can disrupt replication and availability.