CVE-2026-13077: 
MongoDB 脆弱性の分析と軽減

CVE-2026-13077 is an out-of-bounds heap read vulnerability in MongoDB Server's BSON CodeWScope element accessors that allows an authenticated attacker to trigger a server crash or disclose adjacent heap memory contents via a crafted aggregation pipeline. It was published on July 22, 2026, and affects MongoDB Server versions 7.0 before 7.0.39, 8.0 before 8.0.28, 8.2.0 before 8.2.12, and 8.3.0 before 8.3.7. The vulnerability carries a CVSS v4 base score of 7.1 (High) (GitHub Advisory).

The root cause is a missing bounds check (CWE-125: Out-of-bounds Read) in the BSON CodeWScope element accessors within MongoDB's BSONColumn decompression logic. An authenticated attacker can craft malformed BSONColumn data containing a CodeWScope element that bypasses wire-level BSON validation; when the forged element is decompressed, an unchecked size value is used in pointer arithmetic, resulting in a read beyond the intended heap buffer. This attack vector is network-accessible, requires low privileges (authenticated user), and no user interaction, making it straightforward to trigger once access to the database is obtained (GitHub Advisory, MongoDB Jira).

Successful exploitation can result in two distinct outcomes: a denial-of-service condition via server crash, or limited disclosure of adjacent heap memory contents, which may expose sensitive in-memory data such as query results, credentials, or other database contents. The availability impact is rated High, while confidentiality impact is Low, and there is no integrity impact. The vulnerability is scoped to the vulnerable MongoDB Server instance itself, with no direct lateral movement capability, but heap memory disclosure could potentially aid further attacks (GitHub Advisory).

As of the time of publication, there is no known public proof-of-concept exploit and no evidence of in-the-wild exploitation (GitHub Advisory). The EPSS score is approximately 0.24% (15th percentile), indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported. The NVD SSVC assessment classifies exploitation as "none" at this time.

1. Authentication: Obtain valid credentials for the target MongoDB Server instance (e.g., via a low-privileged user account, free trial, or compromised credentials).
2. Craft malformed BSONColumn data: Construct a BSONColumn binary payload containing a CodeWScope element with a manipulated (oversized or otherwise invalid) size field that will pass wire-level BSON validation but trigger the bounds check failure during decompression.
3. Submit via aggregation pipeline: Send the crafted payload to the MongoDB server as part of an aggregation pipeline operation (e.g., using a $group, $project, or similar stage that processes BSONColumn data), targeting an affected version (7.0 < 7.0.39, 8.0 < 8.0.28, 8.2.0 < 8.2.12, 8.3.0 < 8.3.7).
4. Trigger out-of-bounds read: During decompression, the unchecked size value is used in pointer arithmetic, causing the server to read beyond the intended heap buffer boundary.
5. Achieve objective: Depending on the memory layout, the result is either a server crash (denial of service) or the return of adjacent heap memory contents in an error response or query result, potentially disclosing sensitive in-memory data (GitHub Advisory, MongoDB Jira).

• Logs: Unexpected MongoDB server crashes or mongod process restarts; error log entries referencing BSONColumn decompression failures or memory access violations; aggregation pipeline errors involving CodeWScope element processing.
• Network: Authenticated connections from unexpected or low-privileged accounts submitting complex aggregation pipeline queries; unusual query patterns targeting BSONColumn data types.
• Process: Abnormal termination of the mongod process (SIGSEGV or similar signals); core dump files generated in the MongoDB working directory following aggregation operations.
• File System: Presence of core dump files (e.g., core, core.mongod.<pid>) in the MongoDB data or working directory following unexpected crashes.

MongoDB has released patched versions addressing this vulnerability: upgrade to MongoDB Server 7.0.39, 8.0.28, 8.2.12, or 8.3.7 as appropriate for your release track (MongoDB Jira). As a network-level workaround, restrict access to MongoDB instances to trusted clients only using firewall rules or MongoDB's built-in authentication and network binding controls. Monitor for unexpected server crashes or memory access errors as an interim detection measure. Upgrading to a patched version is the recommended and definitive remediation.

Security coverage noted MongoDB patching 26 vulnerabilities in a batch release that included this flaw alongside other memory-related issues (beyondmachines.net). Tenable added detection support via Nessus plugins (330171 and 331215) shortly after disclosure (Tenable). No significant social media controversy or notable individual researcher commentary has been observed for this specific CVE.