Live › vulnerability › CVE-2026-85746
Go to dashboardMariaDB server's ST_AsText function writes past its output buffer when serializing deeply nested GeometryCollection values. A low-privileged remote attacker can corrupt server memory with a crafted GIS object, and may reach code execution when combined with another flaw.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| mariadb | vendor | >= 10.6.1, < 10.6.28 | 10.6.28 |
| mariadb | vendor | >= 10.11.1, < 10.11.19 | 10.11.19 |
| mariadb | vendor | >= 11.4.1, < 11.4.13 | 11.4.13 |
| mariadb | vendor | >= 11.8.1, < 11.8.9 | 11.8.9 |
| mariadb | vendor | >= 12.3.1, < 12.3.3 | 12.3.3 |
| mariadb | vendor | = 13.0.1 | – |
Run SELECT VERSION(); on the server and compare against the fixed releases.
10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, or 13.0.2 (whichever matches your release branch)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, ST_AsText can write beyond an allocated output buffer when converting deeply nested GeometryCollections because recursive WKT serialization does not account for bytes consumed or reserve sufficient space. A low-privileged remote attacker can submit a specially crafted GIS object to corrupt memory and potentially achieve code execution when combined with another vulnerability. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.
This page as .md · .json · in your agent: get_signal("CVE-2026-85746")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.