CVE-2026-4358

MediumPublic PoC

Published: 17 March 2026

Published

17 March 2026

Modified

02 April 2026

KEV Added

—

Patch

—

CVSS Score 6.4 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H

EPSS Score 0.0003 9.0th percentile

Risk Priority 13 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-4358 is a medium-severity Double Free (CWE-415) vulnerability in Mongodb Mongodb. Its CVSS base score is 6.4 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 9.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 SI-16 (Memory Protection) and SI-2 (Flaw Remediation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190) and 1 other technique. What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SI-2 Flaw Remediation good match

prevent

Directly remediates the double-free/use-after-free vulnerability in MongoDB's SBE engine by requiring identification, prioritization, and patching of the specific flaw.

SI-16 Memory Protection good match

prevent

Implements memory protection mechanisms such as non-executable memory and address space randomization to mitigate exploitation of the use-after-free and double-free memory corruption during hash table spills.

AC-6 Least Privilege partial match

prevent

Enforces least privilege to limit write access, reducing the attack surface for authenticated users who could execute the specially crafted $lookup aggregation query.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1499.004 Application or System Exploitation Impact

Adversaries may exploit software vulnerabilities that can cause an application or system to crash and deny availability to users.

attack.mitre.org →

Why these techniques?

CVE describes remote exploitation of a memory corruption flaw in MongoDB (public-facing DB service) via crafted aggregation queries, directly enabling application DoS through exploitation.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

A specially crafted aggregation query with $lookup by an authenticated user with write privileges can cause a double-free or use-after-free memory issue in the slot-based execution (SBE) engine when an in-memory hash table is spilled to disk.

Deeper analysisAI

CVE-2026-4358, published on 2026-03-17, is a double-free or use-after-free memory vulnerability (CWE-415) in MongoDB's slot-based execution (SBE) engine. The issue arises when an authenticated user with write privileges executes a specially crafted aggregation query using the $lookup operator, causing an in-memory hash table to spill to disk and triggering the memory corruption.

An attacker requires low privileges as an authenticated user with write access to exploit this vulnerability over the network (AV:N), though it demands high attack complexity (AC:H) with no user interaction (UI:N) and no scope change (S:U). Successful exploitation yields low confidentiality (C:L) and integrity (I:L) impacts alongside high availability (A:H) impact, per its CVSS v3.1 score of 6.4, potentially enabling denial-of-service through memory corruption.

Mitigation details are documented in the MongoDB JIRA advisory at https://jira.mongodb.org/browse/SERVER-118849.