{"id":"CVE-2026-85746","kind":"vulnerability","aliases":["CVE-2026-85746"],"related":[],"title":"MariaDB server is a community developed fork of MySQL server","description":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, ST_AsText can write beyond an allocated output buffer when converting deeply nested GeometryCollections because recursive WKT serialization does not account for bytes consumed or reserve sufficient space. A low-privileged remote attacker can submit a specially crafted GIS object to corrupt memory and potentially achieve code execution when combined with another vulnerability. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.","summary":"MariaDB server's ST_AsText function writes past its output buffer when serializing deeply nested GeometryCollection values. A low-privileged remote attacker can corrupt server memory with a crafted GIS object, and may reach code execution when combined with another flaw.","severity":"critical","cvss":9.9,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"mariadb","fixed":["10.6.28"],"affected":">= 10.6.1, < 10.6.28","ecosystem":"vendor"},{"name":"mariadb","fixed":["10.11.19"],"affected":">= 10.11.1, < 10.11.19","ecosystem":"vendor"},{"name":"mariadb","fixed":["11.4.13"],"affected":">= 11.4.1, < 11.4.13","ecosystem":"vendor"},{"name":"mariadb","fixed":["11.8.9"],"affected":">= 11.8.1, < 11.8.9","ecosystem":"vendor"},{"name":"mariadb","fixed":["12.3.3"],"affected":">= 12.3.1, < 12.3.3","ecosystem":"vendor"},{"name":"mariadb","fixed":[],"affected":"= 13.0.1","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["database","mariadb","package","self-hosted"],"not_affected_if":["mysql","versions-outside-affected-ranges"],"how_to_check":"Run SELECT VERSION(); on the server and compare against the fixed releases.","fix":"Upgrade MariaDB to 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, or 13.0.2 (whichever matches your release branch).\nUntil patched, restrict which accounts can run spatial functions if the vendor advisory allows it; unknown otherwise.","status":"open","published_at":"2026-10-16T17:17:51+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","triaged_at":"2026-10-23T22:00:00+00:00","updated_at":"2026-10-23T22:28:55+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-23T22:00:00Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade MariaDB to 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, or 13.0.2 (whichever matches your release branch).\nUntil patched, restrict which accounts can run spatial functions if the vendor advisory allows it; unknown otherwise.","reach":"network","impact":"high","summary":"MariaDB server's ST_AsText function writes past its output buffer when serializing deeply nested GeometryCollection values. A low-privileged remote attacker can corrupt server memory with a crafted GIS object, and may reach code execution when combined with another flaw.","category":"package","who_cares":["mariadb","self-hosted","database"],"confidence":0.7,"needs_auth":"yes","worst_case":"Memory corruption in database server, possibly code execution with another flaw","analyst_note":"Confirm the exact affected-version boundary per branch and whether any workaround exists beyond upgrading, via the MariaDB advisory linked from NVD.","how_to_check":"Run SELECT VERSION(); on the server and compare against the fixed releases.\nunknown\nunknown","needs_analyst":true,"not_affected_if":["mysql","versions-outside-affected-ranges"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000523,"input_tokens":2904,"output_tokens":466,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-85746':13A,16A '10.11.19':85C,152C '10.6.1':82C '10.6.28':84C,151C '11.4.13':86C,153C '11.8.9':87C,154C '12.3.3':88C,155C '13.0.2':90C,157C 'account':111C 'achiev':137C 'alloc':97C 'anoth':69B,143C 'astext':33B,92C 'attack':51B,124C 'beyond':95C 'buffer':39B,99C 'byte':113C 'code':64B,138C 'combin':67B,141C 'communiti':5A,75C 'consum':114C 'convert':101C 'corrupt':53B,133C 'craft':58B,129C 'cve':11A,14A 'databas':23B 'deepli':42B,102C 'develop':6A,76C 'execut':65B,139C 'fix':148C 'flaw':70B 'fork':7A,77C 'function':34B 'geometrycollect':44B,104C 'gis':59B,130C 'host':28B 'issu':146C 'low':48B,121C 'low-privileg':47B,120C 'mariadb':1A,17A,18A,19A,20A,21A,22A,24B,29B,71C 'may':62B 'memori':55B,134C 'mysql':9A,79C 'nest':43B,103C 'object':60B,131C 'output':38B,98C 'packag':25B 'past':36B 'potenti':136C 'privileg':49B,122C 'reach':63B 'recurs':106C 'remot':50B,123C 'reserv':116C 'self':27B 'self-host':26B 'serial':41B,108C 'server':2A,10A,30B,54B,72C,80C 'space':118C 'special':128C 'st':32B,91C 'submit':126C 'suffici':117C 'valu':45B 'version':150C 'vulner':144C 'wkt':107C 'write':35B,94C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T17:17:51+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-85746","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85746","severity":null,"published_at":"2026-10-16T17:17:51+00:00","modified_at":"2026-10-20T15:33:00+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}