MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, ST_AsText can write beyond an allocated output buffer when converting deeply nested GeometryCollections because recursive WKT serialization does not account for bytes consumed or reserve sufficient space. A low-privileged remote attacker can submit a specially crafted GIS object to corrupt memory and potentially achieve code execution when combined with another vulnerability. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.
References
| Link | Resource |
|---|---|
| https://github.com/MariaDB/server/commit/5c04ca5524385356ff7cf84974a7d491974c1f85 | Patch |
| https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19 | Release Notes |
| https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28 | Release Notes |
| https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13 | Release Notes |
| https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9 | Release Notes |
| https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3 | Release Notes |
| https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2 | Release Notes |
| https://github.com/MariaDB/server/security/advisories/GHSA-8fvj-c57c-pggx | Vendor Advisory |
| https://jira.mariadb.org/browse/MDEV-40329 | Issue Tracking |
Configurations
Configuration 1 (hide)
|
History
20 Oct 2026, 15:33
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Mariadb mariadb
Mariadb |
|
| CPE | cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:* cpe:2.3:a:mariadb:mariadb:13.0.1:*:*:*:*:*:*:* |
|
| References | () https://github.com/MariaDB/server/commit/5c04ca5524385356ff7cf84974a7d491974c1f85 - Patch | |
| References | () https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19 - Release Notes | |
| References | () https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28 - Release Notes | |
| References | () https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13 - Release Notes | |
| References | () https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9 - Release Notes | |
| References | () https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3 - Release Notes | |
| References | () https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2 - Release Notes | |
| References | () https://github.com/MariaDB/server/security/advisories/GHSA-8fvj-c57c-pggx - Vendor Advisory | |
| References | () https://jira.mariadb.org/browse/MDEV-40329 - Issue Tracking |
16 Oct 2026, 17:17
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-10-16 17:17
Updated : 2026-10-20 15:33
NVD link : CVE-2026-85746
Mitre link : CVE-2026-85746
CVE.ORG link : CVE-2026-85746
JSON object : View
Products Affected
mariadb
- mariadb
CWE
CWE-787
Out-of-bounds Write