Live › vulnerability › CVE-2026-85745
Go to dashboardMariaDB's ST_Area function reads past its buffer when given invalid WKB for a MultiPolygon, because the parser advances without checking that enough input remains. A low-privileged remote attacker can use this to disclose memory, which helps defeat ASLR as part of a larger exploit chain.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Servers running an affected MariaDB release where a low-privileged user can send spatial queries or data to ST_Area on a MultiPolygon value. Installations that do not use spatial functions or do not give users database accounts are less exposed. The sources do not say whether default configurations are affected.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| mariadb | vendor | >= 10.6.1, < 10.6.28 | 10.6.28 |
| mariadb | vendor | >= 10.11.1, < 10.11.19 | 10.11.19 |
| mariadb | vendor | >= 11.4.1, < 11.4.13 | 11.4.13 |
| mariadb | vendor | >= 11.8.1, < 11.8.9 | 11.8.9 |
| mariadb | vendor | >= 12.3.1, < 12.3.3 | 12.3.3 |
| mariadb | vendor | = 13.0.1 | – |
SELECT VERSION(); in the MariaDB client and compare against the fixed versions.10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, or 13.0.2 on the matching release line.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, ST_Area reads beyond the allocated buffer when processing invalid WKB for a MultiPolygon because the multi-polygon parser advances past a nested geometry header without first verifying enough input remains. A low-privileged remote attacker can supply malformed spatial data to disclose memory useful for bypassing ASLR as part of a multi-vulnerability chain. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.
This page as .md · .json · in your agent: get_signal("CVE-2026-85745")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.