CVE-2026-85746
Received Received - Intake

Memory Corruption in MariaDB via ST_AsText GIS Handling

Publication date: 2026-10-16

Last updated on: 2026-10-16

Assigner: GitHub, Inc.

Description
MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, ST_AsText can write beyond an allocated output buffer when converting deeply nested GeometryCollections because recursive WKT serialization does not account for bytes consumed or reserve sufficient space. A low-privileged remote attacker can submit a specially crafted GIS object to corrupt memory and potentially achieve code execution when combined with another vulnerability. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-16
Last Modified
2026-10-16
Generated
2026-10-16
AI Q&A
2026-10-16
EPSS Evaluated
N/A
NVD
CVE-2026-85746
EUVD
EUVD-2026-102940

Affected Vendors & Products

Showing 6 associated CPEs
Vendor Product Version / Range
MariaDB server >= 10.6.1, < 10.6.28
MariaDB server >= 10.11.1, < 10.11.19
MariaDB server >= 11.4.1, < 11.4.13
MariaDB server >= 11.8.1, < 11.8.9
MariaDB server >= 12.3.1, < 12.3.3
MariaDB server >= 13.0.1, < 13.0.2

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-787 The product writes data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a buffer overflow in MariaDB's ST_AsText function when processing deeply nested GeometryCollections. The recursive serialization of WKT (Well-Known Text) geometry objects fails to reserve enough space for the output buffer, causing memory corruption. This can lead to crashes or code execution if combined with another exploit.

Detection Guidance

Detect this vulnerability by checking MariaDB server versions against affected ranges (10.6.1-10.6.27, 10.11.1-10.11.18, 11.4.1-11.4.12, 11.8.1-11.8.8, 12.3.1-12.3.2, 13.0.1). Use commands like 'mysql --version' or 'SELECT VERSION();' to verify versions. Monitor for crashes or hangs when processing GIS objects.

Impact Analysis

A low-privileged remote attacker could submit a specially crafted GIS object to corrupt memory. This may cause system crashes, data corruption, or enable further attacks like remote code execution if additional vulnerabilities are exploited. The impact depends on server configuration and privileges.

Mitigation Strategies

Upgrade MariaDB to patched versions immediately: 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, or 13.0.2. No workarounds exist, so patching is required to prevent potential remote code execution.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-85746. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart