---
id: "CVE-2026-85748"
kind: "vulnerability"
aliases: ["CVE-2026-85748"]
title: "MariaDB server is a community developed fork of MySQL server"
severity: "critical"
cvss: 9.9
epss: null
exploited: false
status: "open"
category: "runtime"
products: [{"name": "mariadb", "fixed": ["12.3.3"], "affected": ">= 12.3.1, < 12.3.3", "ecosystem": "vendor"}, {"name": "mariadb", "fixed": [], "affected": "= 13.0.1", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["database", "mariadb", "runtime", "self-hosted"]
not_affected_if: ["mysql-only-deployments", "versions-outside-affected-range"]
published_at: "2026-10-16T17:17:51+00:00"
first_seen_at: "2026-10-23T21:57:13+00:00"
updated_at: "2026-10-23T22:28:55+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-85748", "first_seen_at": "2026-10-23T21:57:13+00:00"}]
---

# MariaDB server is a community developed fork of MySQL server

MariaDB server versions 12.3.1 through 12.3.3 and 13.0.2 mishandle SYS_REFCURSOR cursor-array reallocation, leaving stale references that cause a use-after-free. A low-privileged database user can trigger it, and it can enable remote code execution when chained with another vulnerability.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:mariadb affected >= 12.3.1, < 12.3.3 fixed 12.3.3
- vendor:mariadb affected = 13.0.1 fixed ?

## How to check

Run SELECT VERSION(); on the MariaDB server and check whether it reports 12.3.1, 12.3.2, or 13.0.0-13.0.2 range builds before the fixed releases.

## Fix

Upgrade MariaDB to 12.3.3 or 13.0.2 (or later in the same branch).

## Timeline

- 2026-10-23T21:57:13+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-85748

## From the sources

MariaDB server is a community developed fork of MySQL server. From 12.3.1 until 12.3.3 and 13.0.2, SYS_REFCURSOR handling is affected because cursor-array reallocation can leave stale references in routine contexts. A low-privileged attacker can open a large number of SYS_REFCURSORs and then fetch one to trigger a use-after-free that can enable remote code execution when combined with another vulnerability. This issue is fixed in versions 12.3.3 and 13.0.2.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_