AccountSubscribe

CVE-2026-118383: Use-after-free vulnerability in MongoDB

Datadog Security LabsNovember 11, 2026Vulnerabilities

We reproduced CVE-2026-118383, a critical use-after-free in MongoDB Server's primary catch-up process that unauthenticated clients can set up, and explain how to detect and remediate it.

Summary from Datadog Security Labs.

Read the full article at Datadog Security Labs

Explained

The technology and terms in this story. Learn more

WeaknessMemory corruptionBugs that let a program write where it shouldn't in memory, often leading to code execution.
ConceptCVE · Common Vulnerabilities and ExposuresThe public ID system for vulnerabilities, such as CVE-2026-12345, so everyone means the same bug.

Why it was possible

The weaknesses behind this story's CVEs, from each CVE Record.

CWE-416Use After FreeThe program keeps using memory after releasing it, so an attacker who controls what lands there next can hijack execution.

Vulnerabilities in this story

Severity and exploitation facts from NVD, FIRST, and CISA.

CVE-2026-118383Critical 9.5

More in Vulnerabilities

N-able Takes N-central Platform Offline After Discovery of 33 Flaws

Dark Reading4h agoVulnerabilities

The global socket: how threat actors are weaponizing GSocket for stealthy C2

Microsoft Security Blog4h agoVulnerabilitiesThreat Intel

Critical RCE Vulnerability in Apache HTTP Server: Everything You Need To Know

Wiz Blog4h agoVulnerabilitiesCloudAppSecCVE-2026-119618

Microsoft Patch Tuesday November 2026, (Tue, Nov 10th)

US-CERT / SANS Internet Storm Center6h agoVulnerabilities

N-able Rushes Out N-central Fixes After 33 Zero-Days Go Public

Infosecurity Magazine7h agoVulnerabilities