CVE-2026-85745

MediumCVSS 4.3/10Last modified Oct 20, 2026

Description

MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, ST_Area reads beyond the allocated buffer when processing invalid WKB for a MultiPolygon because the multi-polygon parser advances past a nested geometry header without first verifying enough input remains. A low-privileged remote attacker can supply malformed spatial data to disclose memory useful for bypassing ASLR as part of a multi-vulnerability chain. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-126

Affected software

Vendor	Product	Versions
MariaDB	server	>= 10.6.1, < 10.6.28; >= 10.11.1, < 10.11.19; >= 11.4.1, < 11.4.13; >= 11.8.1, < 11.8.9; >= 12.3.1, < 12.3.3; >= 13.0.1, < 13.0.2

References

https://github.com/MariaDB/server/commit/2bf355e361db85153fdfba7b8a0f0d114d6a26cePatch
https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19Release Notes
https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28Release Notes
https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13Release Notes
https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9Release Notes
https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3Release Notes
https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2Release Notes
https://github.com/MariaDB/server/security/advisories/GHSA-p7v9-24h4-mch8Vendor Advisory
https://jira.mariadb.org/browse/MDEV-40328Issue Tracking

Timeline

Published: Oct 16, 2026
Last modified: Oct 20, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-857469.9MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, ST_A CVE-2026-857476.8Distribution is a toolkit to pack, ship, store, and deliver container content. Prior to 3.1.2, registry/client.(*manifests).Get() reads a ma CVE-2026-857489.9MariaDB server is a community developed fork of MySQL server. From 12.3.1 until 12.3.3 and 13.0.2, SYS_REFCURSOR handling is affected becaus CVE-2026-857498.1MailWatch for MailScanner is a web-based front-end to MailScanner. Prior to 1.2.27, any authenticated MailWatch user, including the U/user, CVE-2026-85758.3Use after free in UI in Google Chrome prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to potentia CVE-2026-857507.2Piwigo before v16.4.0 is vulnerable to arbitrary file read and remote code execution in image upload handling when using the Imagick library CVE-2026-857519.8Mailu is a mail server distributed as a set of Docker images. From Mailu 2.0 until 2024.06.55 and prior to Mailu helm-charts 2.7.3, deployme CVE-2026-857567.5SSH.NET is a Secure Shell (SSH) library for .NET. Prior to 2026.0.0, ScpClient places caller-supplied remote paths into the command used to CVE-2026-85764.3Inappropriate implementation in CORS in Google Chrome on Linux and ChromeOS prior to 148.0.7778.168 allowed a remote attacker to leak cross-CVE-2026-857696.5A flaw was found in libtpms, a library that provides software TPM 2.0 emulation. When restoring TPM 2.0 state (for example during a virtual CVE-2026-85778.8Integer overflow in Fonts in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to execute arbitrary code inside a sandbox via CVE-2026-85783.1Out of bounds read in GPU in Google Chrome on Linux prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer proce