---
id: "CVE-2026-85745"
kind: "vulnerability"
aliases: ["CVE-2026-85745"]
title: "MariaDB: malformed spatial data in ST_Area leaks server memory"
severity: "medium"
cvss: 4.3
epss: null
exploited: false
status: "open"
category: "runtime"
products: [{"name": "mariadb", "fixed": ["10.6.28"], "affected": ">= 10.6.1, < 10.6.28", "ecosystem": "vendor"}, {"name": "mariadb", "fixed": ["10.11.19"], "affected": ">= 10.11.1, < 10.11.19", "ecosystem": "vendor"}, {"name": "mariadb", "fixed": ["11.4.13"], "affected": ">= 11.4.1, < 11.4.13", "ecosystem": "vendor"}, {"name": "mariadb", "fixed": ["11.8.9"], "affected": ">= 11.8.1, < 11.8.9", "ecosystem": "vendor"}, {"name": "mariadb", "fixed": ["12.3.3"], "affected": ">= 12.3.1, < 12.3.3", "ecosystem": "vendor"}, {"name": "mariadb", "fixed": [], "affected": "= 13.0.1", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["database", "mariadb", "runtime", "self-hosted"]
not_affected_if: ["managed-hosting", "no-spatial-queries"]
published_at: "2026-10-16T17:17:51+00:00"
first_seen_at: "2026-10-23T21:57:13+00:00"
updated_at: "2026-10-25T04:39:57+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-85745", "first_seen_at": "2026-10-23T21:57:13+00:00"}]
---

# MariaDB: malformed spatial data in ST_Area leaks server memory

MariaDB's ST_Area function reads past its buffer when given invalid WKB for a MultiPolygon, because the parser advances without checking that enough input remains. A low-privileged remote attacker can use this to disclose memory, which helps defeat ASLR as part of a larger exploit chain.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:mariadb affected >= 10.6.1, < 10.6.28 fixed 10.6.28
- vendor:mariadb affected >= 10.11.1, < 10.11.19 fixed 10.11.19
- vendor:mariadb affected >= 11.4.1, < 11.4.13 fixed 11.4.13
- vendor:mariadb affected >= 11.8.1, < 11.8.9 fixed 11.8.9
- vendor:mariadb affected >= 12.3.1, < 12.3.3 fixed 12.3.3
- vendor:mariadb affected = 13.0.1 fixed ?

## How to check

- Run `SELECT VERSION();` in the MariaDB client and compare against the fixed versions.
- Check whether the server is in an affected range: 10.6.1 to before 10.6.28, 10.11.1 to before 10.11.19, 11.4.1 to before 11.4.13, 11.8.1 to before 11.8.9, 12.3.1 to before 12.3.3, or 13.0.1 (13.0.2 is listed as fixed in the description but the product entry shows no fixed version).

## Fix

- Upgrade MariaDB to `10.6.28`, `10.11.19`, `11.4.13`, `11.8.9`, `12.3.3`, or `13.0.2` on the matching release line.

## Timeline

- 2026-10-23T21:57:13+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-85745

## From the sources

MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, ST_Area reads beyond the allocated buffer when processing invalid WKB for a MultiPolygon because the multi-polygon parser advances past a nested geometry header without first verifying enough input remains. A low-privileged remote attacker can supply malformed spatial data to disclose memory useful for bypassing ASLR as part of a multi-vulnerability chain. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_