CVE-2026-85746

CriticalCVSS 9.9/10Last modified Oct 20, 2026

Description

MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, ST_AsText can write beyond an allocated output buffer when converting deeply nested GeometryCollections because recursive WKT serialization does not account for bytes consumed or reserve sufficient space. A low-privileged remote attacker can submit a specially crafted GIS object to corrupt memory and potentially achieve code execution when combined with another vulnerability. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.

Metrics

CVSS 3.1 9.9/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-787

Affected software

Vendor	Product	Versions
MariaDB	server	>= 10.6.1, < 10.6.28; >= 10.11.1, < 10.11.19; >= 11.4.1, < 11.4.13; >= 11.8.1, < 11.8.9; >= 12.3.1, < 12.3.3; >= 13.0.1, < 13.0.2

References

https://github.com/MariaDB/server/commit/5c04ca5524385356ff7cf84974a7d491974c1f85Patch
https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19Release Notes
https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28Release Notes
https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13Release Notes
https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9Release Notes
https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3Release Notes
https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2Release Notes
https://github.com/MariaDB/server/security/advisories/GHSA-8fvj-c57c-pggxVendor Advisory
https://jira.mariadb.org/browse/MDEV-40329Issue Tracking

Timeline

Published: Oct 16, 2026
Last modified: Oct 20, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-857476.8Distribution is a toolkit to pack, ship, store, and deliver container content. Prior to 3.1.2, registry/client.(*manifests).Get() reads a ma CVE-2026-857489.9MariaDB server is a community developed fork of MySQL server. From 12.3.1 until 12.3.3 and 13.0.2, SYS_REFCURSOR handling is affected becaus CVE-2026-85758.3Use after free in UI in Google Chrome prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to potentia CVE-2026-857507.2Piwigo before v16.4.0 is vulnerable to arbitrary file read and remote code execution in image upload handling when using the Imagick library CVE-2026-857519.8Mailu is a mail server distributed as a set of Docker images. From Mailu 2.0 until 2024.06.55 and prior to Mailu helm-charts 2.7.3, deployme CVE-2026-857567.5SSH.NET is a Secure Shell (SSH) library for .NET. Prior to 2026.0.0, ScpClient places caller-supplied remote paths into the command used to CVE-2026-85764.3Inappropriate implementation in CORS in Google Chrome on Linux and ChromeOS prior to 148.0.7778.168 allowed a remote attacker to leak cross-CVE-2026-857696.5A flaw was found in libtpms, a library that provides software TPM 2.0 emulation. When restoring TPM 2.0 state (for example during a virtual CVE-2026-85778.8Integer overflow in Fonts in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to execute arbitrary code inside a sandbox via CVE-2026-85783.1Out of bounds read in GPU in Google Chrome on Linux prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer proce CVE-2026-857818.7Unverified ownership of a storage access point in the volume deletion component of the Amazon EFS CSI Driver before v3.4.1 might allow an au CVE-2026-85783Crypt::Age versions before 0.004 for Perl allow CPU exhaustion via an unbounded number of recipient stanzas, each costing an X25519 scalar m