CVE-2026-120803

A use-after-free issue exists in MongoDB’s SBE Slot-Based Execution implementation of a window function accumulator used by certain $setWindowFields aggregation pipelines. Under specific conditions, the accumulator can retain a dangling pointer to memory that has since been freed. When this stale...