CVE-2026-85746
published 2026-10-16CVE-2026-85746: MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, ST_AsText can write…
PriorityP267critical9.9CVSS 3.1
AVNACLPRLUINSCCHIHAH
EPSS
0.97%
61.7th percentile
MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, ST_AsText can write beyond an allocated output buffer when converting deeply nested GeometryCollections because recursive WKT serialization does not account for bytes consumed or reserve sufficient space. A low-privileged remote attacker can submit a specially crafted GIS object to corrupt memory and potentially achieve code execution when combined with another vulnerability. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.
Affected
16 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| mariadb | mariadb | — | — |
| mariadb | mariadb | — | — |
| mariadb | mariadb | >= 10.11.1 < 10.11.19 | 10.11.19 |
| mariadb | mariadb | >= 10.6.1 < 10.6.28 | 10.6.28 |
| mariadb | mariadb | >= 11.4.1 < 11.4.13 | 11.4.13 |
| mariadb | mariadb | >= 11.8.1 < 11.8.9 | 11.8.9 |
| mariadb | mariadb | >= 12.3.1 < 12.3.3 | 12.3.3 |
| mariadb | server | — | — |
| mariadb | server | — | — |
| mariadb | server | — | — |
| mariadb | server | — | — |
| mariadb | server | — | — |
| mariadb | server | — | — |
| mariadb_10.11 | mariadb | — | — |
| mariadb_10.3 | mariadb | — | — |
| mariadb_11.8 | mariadb | — | — |
CVSS provenance
nvdv3.19.9CRITICALCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
vendor_redhat9.9CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-85746 mariadb10.11: MariaDB: Out-of-bound buffer write on in `ST_AsText` of nested GeometryCollections [fedora-all]
bugzilla·2026-10-23·CVSS 9.9
CVE-2026-85746 [CRITICAL] CVE-2026-85746 mariadb10.11: MariaDB: Out-of-bound buffer write on in `ST_AsText` of nested GeometryCollections [fedora-all]
CVE-2026-85746 mariadb10.11: MariaDB: Out-of-bound buffer write on in `ST_AsText` of nested GeometryCollections [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, ST_AsText can write beyond an allocated output buffer when converting deeply nested GeometryCollections because recursive WKT serialization does not account for bytes consumed or reserve sufficient space. A low-privileged remote attacker can submit a specially crafted GIS object to corrupt memory and potentially
Bugzilla
CVE-2026-85746 mariadb11.8: MariaDB: Out-of-bound buffer write on in `ST_AsText` of nested GeometryCollections [fedora-all]
bugzilla·2026-10-23·CVSS 9.9
CVE-2026-85746 [CRITICAL] CVE-2026-85746 mariadb11.8: MariaDB: Out-of-bound buffer write on in `ST_AsText` of nested GeometryCollections [fedora-all]
CVE-2026-85746 mariadb11.8: MariaDB: Out-of-bound buffer write on in `ST_AsText` of nested GeometryCollections [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, ST_AsText can write beyond an allocated output buffer when converting deeply nested GeometryCollections because recursive WKT serialization does not account for bytes consumed or reserve sufficient space. A low-privileged remote attacker can submit a specially crafted GIS object to corrupt memory and potentially
Bugzilla
CVE-2026-85746 mariadb12.3: MariaDB: Out-of-bound buffer write on in `ST_AsText` of nested GeometryCollections [fedora-all]
bugzilla·2026-10-23·CVSS 9.9
CVE-2026-85746 [CRITICAL] CVE-2026-85746 mariadb12.3: MariaDB: Out-of-bound buffer write on in `ST_AsText` of nested GeometryCollections [fedora-all]
CVE-2026-85746 mariadb12.3: MariaDB: Out-of-bound buffer write on in `ST_AsText` of nested GeometryCollections [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, ST_AsText can write beyond an allocated output buffer when converting deeply nested GeometryCollections because recursive WKT serialization does not account for bytes consumed or reserve sufficient space. A low-privileged remote attacker can submit a specially crafted GIS object to corrupt memory and potentially
Bugzilla
CVE-2026-85746 mariadb: MariaDB: Out-of-bound buffer write on in `ST_AsText` of nested GeometryCollections
bugzilla·2026-10-16·CVSS 9.9
CVE-2026-85746 [CRITICAL] CVE-2026-85746 mariadb: MariaDB: Out-of-bound buffer write on in `ST_AsText` of nested GeometryCollections
CVE-2026-85746 mariadb: MariaDB: Out-of-bound buffer write on in `ST_AsText` of nested GeometryCollections
MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, ST_AsText can write beyond an allocated output buffer when converting deeply nested GeometryCollections because recursive WKT serialization does not account for bytes consumed or reserve sufficient space. A low-privileged remote attacker can submit a specially crafted GIS object to corrupt memory and potentially achieve code execution when combined with another vulnerability. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.
https://github.com/MariaDB/server/commit/5c04ca5524385356ff7cf84974a7d491974c1f85https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2https://github.com/MariaDB/server/security/advisories/GHSA-8fvj-c57c-pggxhttps://jira.mariadb.org/browse/MDEV-40329
2026-10-16
Published