CVE-2026-85745
Received Received - Intake

Buffer Overflow in MariaDB Server via ST_Area Function

Publication date: 2026-10-16

Last updated on: 2026-10-16

Assigner: GitHub, Inc.

Description
MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, ST_Area reads beyond the allocated buffer when processing invalid WKB for a MultiPolygon because the multi-polygon parser advances past a nested geometry header without first verifying enough input remains. A low-privileged remote attacker can supply malformed spatial data to disclose memory useful for bypassing ASLR as part of a multi-vulnerability chain. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-16
Last Modified
2026-10-16
Generated
2026-10-16
AI Q&A
2026-10-16
EPSS Evaluated
N/A
NVD
CVE-2026-85745
EUVD
EUVD-2026-102942

Affected Vendors & Products

Showing 6 associated CPEs
Vendor Product Version / Range
MariaDB server >= 10.6.1, < 10.6.28
MariaDB server >= 10.11.1, < 10.11.19
MariaDB server >= 11.4.1, < 11.4.13
MariaDB server >= 11.8.1, < 11.8.9
MariaDB server >= 12.3.1, < 12.3.3
MariaDB server >= 13.0.1, < 13.0.2

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-126 The product reads from a buffer using buffer access mechanisms such as indexes or pointers that reference memory locations after the targeted buffer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an out-of-bounds buffer read issue in MariaDB's ST_Area() function when processing a MultiPolygon in an invalid WKB (Well-Known Binary) format. The multi-polygon parser advances past a nested geometry header without verifying enough input remains, causing it to read beyond the allocated buffer. This allows a low-privileged remote attacker to disclose memory that could be used to bypass ASLR as part of a multi-step attack chain.

Detection Guidance

This vulnerability can be detected by checking MariaDB server versions against affected releases (10.6.1-10.6.27, 10.11.1-10.11.18, 11.4.1-11.4.12, 11.8.1-11.8.8, 12.3.1-12.3.2, 13.0.1). Use commands like 'mysql --version' or 'mariadb --version' to check the installed version.

Impact Analysis

An attacker could exploit this to read sensitive memory contents, potentially revealing information useful for bypassing security mechanisms like ASLR. This could facilitate further attacks, though it requires the attacker to supply malformed spatial data to the vulnerable MariaDB server.

Mitigation Strategies

Upgrade MariaDB to a patched version (10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, or 13.0.2) immediately. No workarounds are available. Monitor MariaDB logs for suspicious spatial queries, especially involving ST_Area with malformed WKB data.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-85745. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart