CVE-2026-85746

9.9Critical

Published 16 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash

9.9Critical

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: None
Impact: Full C/I/A compromise
Weakness: CWE-787

Impact

Authenticated low-privileged remote attackers can corrupt memory and potentially execute arbitrary code on the database host. They need valid credentials to submit crafted GIS objects to the server.

Root cause

A heap out-of-bounds write occurs in ST_AsText because recursive WKT serialization fails to track consumed bytes or reserve adequate buffer space for deeply nested GeometryCollections.

Affected systems

MariaDB server 10.6.1 before 10.6.28, before 10.11.19, before 11.4.13, before 11.8.9, before 12.3.3, and before 13.0.2

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Fix & remediation

Upgrade to MariaDB server 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, or 13.0.2. No interim workaround is documented; restrict database network access to trusted clients until patched.

shell

$ sudo apt-get update && sudo apt-get install --only-upgrade mariadb-server

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, ST_AsText can write beyond an allocated output buffer when converting deeply nested GeometryCollections because recursive WKT serialization does not account for bytes consumed or reserve sufficient space. A low-privileged remote attacker can submit a specially crafted GIS object to corrupt memory and potentially achieve code execution when combined with another vulnerability. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-85746