CVE-2026-13077: A missing bounds check in the BSON CodeWScope element accessors allows an attacker to trigger an out-of-bounds heap read via a crafted aggregation pipeline. The vulnerability can b

highCVSS 7.1CVE-2026-13077

A missing bounds check in the BSON CodeWScope element accessors allows an attacker to trigger an out-of-bounds heap read via a crafted aggregation pipeline. The vulnerability can be exploited by an authenticated user by generating a malformed BSONColumn data containing a CodeWScope element, bypassing wire-level BSON validation. When the forged element is decompressed, the unchecked size value is used in pointer arithmetic, causing either a server crash or disclosure of adjacent heap memory contents.

Details

Source: NVD Recent CVEs (US · database · site)
Severity: high — CVSS 7.1
Published: 2026-07-22
Last updated: 2026-07-23
Exploitation: Not in CISA KEV at last sync

Original advisory: https://nvd.nist.gov/vuln/detail/CVE-2026-13077

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

Low exploitation riskCVE-2026-130770.24% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 15% of all scored CVEs.

Referenced CVEs

CVE	CSIRTS overview	External
CVE-2026-13077	coverage & exploitation status	NVD · CVE.org

Same CVEs, other sources

How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.

unknownMongoDB Multiple Vulnerabilitieshkcert
unknownMultiple vulnerabilities in MongoDB (July 24, 2026)cert-fr-avis
high[NEW] [high] MongoDB: Multiple vulnerabilitiescert-bund

Recent advisories for A missing bounds

A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.

highCVE-2026-66034: libssh2 through 1.11.1, fixed in commit a13bb6c, contains a missing bounds check vulnerability…nvd · 2026-07-24
criticalCVE-2026-41252: xrdp is an open source RDP server. Versions 0.10.6 and prior contain a missing bounds check in…nvd · 2026-07-20
criticalCVE-2026-51807: Heap-based out-of-bounds write in j2k_precinct_subband::parse_packet_header() in OpenHTJ2K ver…nvd · 2026-07-14
highCVE-2026-56002: A heap bufferflow in pcfReadFont() due to missing glyph bounds checking in libXfont2 before 2.…nvd · 2026-07-08
mediumCVE-2026-38973: mrubyc through release3.4.1 was found to contain an out-of-bounds read in builtin missing-meth…nvd · 2026-07-06
highCVE-2026-4967: In IMS, there is a possible out of bounds read due to a missing bounds check. This could lead t…nvd · 2026-07-03