CVE-2026-13077: BSON CodeWScope Buffer Overflow Vulnerability

CVE-2026-13077 Overview

CVE-2026-13077 is an out-of-bounds read vulnerability [CWE-125] affecting MongoDB's Binary JSON (BSON) CodeWScope element accessors. The flaw stems from a missing bounds check that an authenticated attacker can trigger through a crafted aggregation pipeline. By generating malformed BSONColumn data containing a CodeWScope element, the attacker bypasses wire-level BSON validation. When the server decompresses the forged element, it uses the unchecked size value in pointer arithmetic. The result is either a server crash or the disclosure of adjacent heap memory contents. The issue is tracked in MongoDB Jira as SERVER-129103.

Critical Impact
An authenticated user can crash the database server or read adjacent heap memory, potentially exposing sensitive in-memory data through a crafted aggregation pipeline.

Affected Products

MongoDB Server (versions referenced in MongoDB Jira issue SERVER-129103)
Deployments processing untrusted BSONColumn data through aggregation pipelines
Environments where low-privileged authenticated users can submit aggregation queries

Discovery Timeline

2026-07-22 - CVE-2026-13077 published to the National Vulnerability Database
2026-07-22 - Last updated in NVD database

Technical Details for CVE-2026-13077

Vulnerability Analysis

The vulnerability resides in the accessors for BSON CodeWScope elements. CodeWScope is a BSON type that stores JavaScript code together with an associated scope document. Each element carries a length prefix used to locate the code string and the embedded scope. The accessors read this length field and use it directly in pointer arithmetic without validating that the size stays within the enclosing buffer.

MongoDB normally applies wire-level BSON validation to reject malformed documents on ingress. However, the vulnerability can be reached by embedding the forged CodeWScope element inside BSONColumn compressed data. The compressed representation is decompressed after wire validation completes, so the malformed element enters the pipeline unchecked. When the aggregation stage subsequently invokes a CodeWScope accessor, the unchecked size drives an out-of-bounds heap read.

Root Cause

The root cause is missing input validation [CWE-125] in the CodeWScope element accessors. The code trusts the length field supplied by the caller-controlled BSON data and performs pointer arithmetic without checking it against the actual buffer bounds. The BSONColumn decompression path provides a channel that bypasses upstream validators.

Attack Vector

Exploitation requires an authenticated session with privileges to run aggregation pipelines. The attacker constructs BSONColumn data containing a CodeWScope element whose embedded size field points past the end of the allocated buffer. Submitting this data through an aggregation pipeline triggers the accessor. Successful exploitation crashes the mongod process, causing denial of service, or leaks contents of adjacent heap memory to the client. The attack is remote and network-reachable, but it does not provide integrity impact or code execution.

No verified public exploit code is available. See MongoDB Jira Issue SERVER-129103 for authoritative technical details.

Detection Methods for CVE-2026-13077

Indicators of Compromise

Unexpected mongod process crashes or restarts with stack traces referencing BSON element accessors or BSONColumn decompression
Aggregation queries submitted by low-privileged accounts containing BSONColumn payloads with CodeWScope elements
Repeated malformed BSON parsing errors in MongoDB logs from a single authenticated principal

Detection Strategies

Enable MongoDB audit logging and alert on aggregation commands from accounts that do not normally issue them
Correlate mongod crash events with the identity and source address of the last executed aggregation pipeline
Inspect application-layer traffic to database endpoints for oversized or structurally anomalous BSONColumn payloads

Monitoring Recommendations

Track process supervision events for mongod restart loops indicating repeated crash attempts
Monitor authentication logs for privilege changes granting aggregation execution to non-administrative users
Baseline query patterns per service account and alert on deviations involving compressed BSON columns

How to Mitigate CVE-2026-13077

Immediate Actions Required

Apply the MongoDB security update associated with SERVER-129103 as soon as it is available for your release train
Audit database roles and remove aggregation privileges from accounts that do not require them
Restrict network access to mongod instances so only trusted application tiers can authenticate

Patch Information

Refer to MongoDB Jira Issue SERVER-129103 for the fix commit, backport status, and the list of patched MongoDB Server versions. Upgrade to a version that includes the bounds check fix in the CodeWScope accessors and the BSONColumn decompression path.

Workarounds

Enforce least privilege on database users so that only vetted service accounts can execute aggregation pipelines
Terminate connections from authenticated principals that submit malformed BSON payloads
Deploy the mongod process behind a network segment that blocks direct client access from untrusted zones

bash

# Revoke aggregation-capable roles from a suspect user until patched
mongosh --eval 'db.getSiblingDB("admin").revokeRolesFromUser("suspect_user", ["readWrite", "dbOwner"])'

# Verify installed server version after applying the SERVER-129103 fix
mongosh --quiet --eval 'db.version()'