{"id":"CVE-2026-85745","kind":"vulnerability","aliases":["CVE-2026-85745"],"related":[],"title":"MariaDB: malformed spatial data in ST_Area leaks server memory","description":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, ST_Area reads beyond the allocated buffer when processing invalid WKB for a MultiPolygon because the multi-polygon parser advances past a nested geometry header without first verifying enough input remains. A low-privileged remote attacker can supply malformed spatial data to disclose memory useful for bypassing ASLR as part of a multi-vulnerability chain. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.","summary":"MariaDB's ST_Area function reads past its buffer when given invalid WKB for a MultiPolygon, because the parser advances without checking that enough input remains. A low-privileged remote attacker can use this to disclose memory, which helps defeat ASLR as part of a larger exploit chain.","severity":"medium","cvss":4.3,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"mariadb","fixed":["10.6.28"],"affected":">= 10.6.1, < 10.6.28","ecosystem":"vendor"},{"name":"mariadb","fixed":["10.11.19"],"affected":">= 10.11.1, < 10.11.19","ecosystem":"vendor"},{"name":"mariadb","fixed":["11.4.13"],"affected":">= 11.4.1, < 11.4.13","ecosystem":"vendor"},{"name":"mariadb","fixed":["11.8.9"],"affected":">= 11.8.1, < 11.8.9","ecosystem":"vendor"},{"name":"mariadb","fixed":["12.3.3"],"affected":">= 12.3.1, < 12.3.3","ecosystem":"vendor"},{"name":"mariadb","fixed":[],"affected":"= 13.0.1","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["database","mariadb","runtime","self-hosted"],"not_affected_if":["managed-hosting","no-spatial-queries"],"how_to_check":"- Run `SELECT VERSION();` in the MariaDB client and compare against the fixed versions.\n- Check whether the server is in an affected range: 10.6.1 to before 10.6.28, 10.11.1 to before 10.11.19, 11.4.1 to before 11.4.13, 11.8.1 to before 11.8.9, 12.3.1 to before 12.3.3, or 13.0.1 (13.0.2 is listed as fixed in the description but the product entry shows no fixed version).","fix":"- Upgrade MariaDB to `10.6.28`, `10.11.19`, `11.4.13`, `11.8.9`, `12.3.3`, or `13.0.2` on the matching release line.","status":"open","published_at":"2026-10-16T17:17:51+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","triaged_at":"2026-10-25T04:39:57+00:00","updated_at":"2026-10-25T04:39:57+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-10-25T04:39:57Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade MariaDB to `10.6.28`, `10.11.19`, `11.4.13`, `11.8.9`, `12.3.3`, or `13.0.2` on the matching release line.","reach":"network","title":"MariaDB: malformed spatial data in ST_Area leaks server memory","impact":"low","summary":"MariaDB's ST_Area function reads past its buffer when given invalid WKB for a MultiPolygon, because the parser advances without checking that enough input remains. A low-privileged remote attacker can use this to disclose memory, which helps defeat ASLR as part of a larger exploit chain.","category":"runtime","nicknames":[],"who_cares":["mariadb","self-hosted","database"],"confidence":0.6,"needs_auth":"yes","worst_case":"Attacker reads server memory, aiding a later exploit chain","analyst_note":"Sources conflict on the fixed version for 13.x: description says 13.0.2 is fixed, product entry shows affected = 13.0.1 with fixed unknown; confirm against the MariaDB advisory.","how_to_check":"- Run `SELECT VERSION();` in the MariaDB client and compare against the fixed versions.\n- Check whether the server is in an affected range: 10.6.1 to before 10.6.28, 10.11.1 to before 10.11.19, 11.4.1 to before 11.4.13, 11.8.1 to before 11.8.9, 12.3.1 to before 12.3.3, or 13.0.1 (13.0.2 is listed as fixed in the description but the product entry shows no fixed version).","needs_analyst":true,"not_affected_if":["managed-hosting","no-spatial-queries"],"who_is_affected":"Servers running an affected MariaDB release where a low-privileged user can send spatial queries or data to ST_Area on a MultiPolygon value. Installations that do not use spatial functions or do not give users database accounts are less exposed. The sources do not say whether default configurations are affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000727,"input_tokens":3650,"output_tokens":723,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-85745':13A,16A '10.11.19':92C,163C '10.6.1':89C '10.6.28':91C,162C '11.4.13':93C,164C '11.8.9':94C,165C '12.3.3':95C,166C '13.0.2':97C,168C 'advanc':48B,118C 'alloc':103C 'area':7A,32B,99C 'aslr':70B,147C 'attack':60B,135C 'beyond':101C 'buffer':37B,104C 'bypass':146C 'chain':77B,155C 'check':50B 'communiti':82C 'cve':11A,14A 'data':4A,140C 'databas':23B 'defeat':69B 'develop':83C 'disclos':65B,142C 'enough':52B,127C 'exploit':76B 'first':125C 'fix':159C 'fork':84C 'function':33B 'geometri':122C 'given':39B 'header':123C 'help':68B 'host':28B 'input':53B,128C 'invalid':40B,107C 'issu':157C 'larger':75B 'leak':8A 'low':57B,132C 'low-privileg':56B,131C 'malform':2A,138C 'mariadb':1A,17A,18A,19A,20A,21A,22A,24B,29B,78C 'memori':10A,66B,143C 'multi':115C,153C 'multi-polygon':114C 'multi-vulner':152C 'multipolygon':44B,111C 'mysql':86C 'nest':121C 'parser':47B,117C 'part':72B,149C 'past':35B,119C 'polygon':116C 'privileg':58B,133C 'process':106C 'read':34B,100C 'remain':54B,129C 'remot':59B,134C 'runtim':25B 'self':27B 'self-host':26B 'server':9A,79C,87C 'spatial':3A,139C 'st':6A,31B,98C 'suppli':137C 'use':62B,144C 'verifi':126C 'version':161C 'vulner':154C 'without':49B,124C 'wkb':41B,108C","nicknames":[],"mitigations":[],"who_affected":"Servers running an affected MariaDB release where a low-privileged user can send spatial queries or data to ST_Area on a MultiPolygon value. Installations that do not use spatial functions or do not give users database accounts are less exposed. The sources do not say whether default configurations are affected.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T17:17:51+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-85745","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85745","severity":null,"published_at":"2026-10-16T17:17:51+00:00","modified_at":"2026-10-20T15:33:09+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}