---
id: "CVE-2026-85746"
kind: "vulnerability"
aliases: ["CVE-2026-85746"]
title: "MariaDB server is a community developed fork of MySQL server"
severity: "critical"
cvss: 9.9
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "mariadb", "fixed": ["10.6.28"], "affected": ">= 10.6.1, < 10.6.28", "ecosystem": "vendor"}, {"name": "mariadb", "fixed": ["10.11.19"], "affected": ">= 10.11.1, < 10.11.19", "ecosystem": "vendor"}, {"name": "mariadb", "fixed": ["11.4.13"], "affected": ">= 11.4.1, < 11.4.13", "ecosystem": "vendor"}, {"name": "mariadb", "fixed": ["11.8.9"], "affected": ">= 11.8.1, < 11.8.9", "ecosystem": "vendor"}, {"name": "mariadb", "fixed": ["12.3.3"], "affected": ">= 12.3.1, < 12.3.3", "ecosystem": "vendor"}, {"name": "mariadb", "fixed": [], "affected": "= 13.0.1", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["database", "mariadb", "package", "self-hosted"]
not_affected_if: ["mysql", "versions-outside-affected-ranges"]
published_at: "2026-10-16T17:17:51+00:00"
first_seen_at: "2026-10-23T21:57:13+00:00"
updated_at: "2026-10-23T22:28:55+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-85746", "first_seen_at": "2026-10-23T21:57:13+00:00"}]
---

# MariaDB server is a community developed fork of MySQL server

MariaDB server's ST_AsText function writes past its output buffer when serializing deeply nested GeometryCollection values. A low-privileged remote attacker can corrupt server memory with a crafted GIS object, and may reach code execution when combined with another flaw.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:mariadb affected >= 10.6.1, < 10.6.28 fixed 10.6.28
- vendor:mariadb affected >= 10.11.1, < 10.11.19 fixed 10.11.19
- vendor:mariadb affected >= 11.4.1, < 11.4.13 fixed 11.4.13
- vendor:mariadb affected >= 11.8.1, < 11.8.9 fixed 11.8.9
- vendor:mariadb affected >= 12.3.1, < 12.3.3 fixed 12.3.3
- vendor:mariadb affected = 13.0.1 fixed ?

## How to check

Run SELECT VERSION(); on the server and compare against the fixed releases.

## Fix

Upgrade MariaDB to 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, or 13.0.2 (whichever matches your release branch).
Until patched, restrict which accounts can run spatial functions if the vendor advisory allows it; unknown otherwise.

## Timeline

- 2026-10-23T21:57:13+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-85746

## From the sources

MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, ST_AsText can write beyond an allocated output buffer when converting deeply nested GeometryCollections because recursive WKT serialization does not account for bytes consumed or reserve sufficient space. A low-privileged remote attacker can submit a specially crafted GIS object to corrupt memory and potentially achieve code execution when combined with another vulnerability. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_