A use-after-free vulnerability exists in MongoDB's Field-Level Encryption (FLE) query analysis component, affecting client-side uses of mongocryptd and crypt_shared. Triggering this vulnerability requires control over the structure of a client's FLE-related query.
This issue impacts MongoDB Server’s mongocryptd component v7.0 versions prior to 7.0.34, v8.0 versions prior to 8.0.23, v8.2 versions prior to 8.2.9 and v8.3 versions prior to 8.3.2.
< 7.0.34 - AFFECTED
< 8.0.23 - AFFECTED
< 8.2.9 - AFFECTED
< 8.3.2 - AFFECTED
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-8201",
"assignerOrgId": "a39b4221-9bd0-4244-95fc-f3e2e07f1deb",
"assignerShortName": "mongodb",
"dateUpdated": "2026-05-13T00:12:35.299Z",
"dateReserved": "2026-05-08T23:42:58.650Z",
"datePublished": "2026-05-13T00:12:35.299Z",
"state": "PUBLISHED"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "a39b4221-9bd0-4244-95fc-f3e2e07f1deb",
"shortName": "mongodb",
"dateUpdated": "2026-05-13T00:12:35.299Z"
},
"title": "Use-After-Free in MongoDB FLE Query Analysis When Processing Positional Projections on Encrypted Fields",
"descriptions": [
{
"lang": "en",
"value": "A use-after-free vulnerability exists in MongoDB's Field-Level Encryption (FLE) query analysis component, affecting client-side uses of mongocryptd and crypt_shared. Triggering this vulnerability requires control over the structure of a client's FLE-related query.\n\nThis issue impacts MongoDB Server’s mongocryptd component v7.0 versions prior to 7.0.34, v8.0 versions prior to 8.0.23, v8.2 versions prior to 8.2.9 and v8.3 versions prior to 8.3.2.",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "A use-after-free vulnerability exists in MongoDB's Field-Level Encryption (FLE) query analysis component, affecting client-side uses of mongocryptd and crypt_shared. Triggering this vulnerability requires control over the structure of a client's FLE-related query.<br><br>This issue impacts MongoDB Server’s mongocryptd component v7.0 versions prior to 7.0.34, v8.0 versions prior to 8.0.23, v8.2 versions prior to 8.2.9 and v8.3 versions prior to 8.3.2.<br><br><br><br>"
}
]
}
],
"affected": [
{
"vendor": "MongoDB, Inc.",
"product": "MongoDB Server",
"defaultStatus": "unaffected",
"versions": [
{
"version": "7.0",
"status": "affected",
"versionType": "custom",
"lessThan": "7.0.34"
},
{
"version": "8.0",
"status": "affected",
"versionType": "custom",
"lessThan": "8.0.23"
},
{
"version": "8.2",
"status": "affected",
"versionType": "custom",
"lessThan": "8.2.9"
},
{
"version": "8.3",
"status": "affected",
"versionType": "custom",
"lessThan": "8.3.2"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"description": "CWE-416: Use After Free",
"cweId": "CWE-416",
"type": "CWE"
}
]
}
],
"references": [
{
"url": "https://jira.mongodb.org/browse/SERVER-122032",
"tags": [
"issue-tracking"
]
}
],
"metrics": [
{
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
],
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H",
"attackVector": "NETWORK",
"attackComplexity": "HIGH",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"availabilityImpact": "HIGH",
"baseScore": 6.4,
"baseSeverity": "MEDIUM"
}
}
]
}
}
}