CVE-2026-85748
published 2026-10-16CVE-2026-85748: MariaDB server is a community developed fork of MySQL server. From 12.3.1 until 12.3.3 and 13.0.2, SYS_REFCURSOR handling is affected because cursor-array…
PriorityP269critical9.9CVSS 3.1
AVNACLPRLUINSCCHIHAH
EPSS
0.55%
45.1th percentile
MariaDB server is a community developed fork of MySQL server. From 12.3.1 until 12.3.3 and 13.0.2, SYS_REFCURSOR handling is affected because cursor-array reallocation can leave stale references in routine contexts. A low-privileged attacker can open a large number of SYS_REFCURSORs and then fetch one to trigger a use-after-free that can enable remote code execution when combined with another vulnerability. This issue is fixed in versions 12.3.3 and 13.0.2.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| mariadb | mariadb | — | — |
| mariadb | mariadb | >= 12.3.1 < 12.3.3 | 12.3.3 |
| mariadb | server | — | — |
| mariadb | server | — | — |
CVSS provenance
nvdv3.19.9CRITICALCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
vendor_redhat9.9CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-85748 mariadb12.3: mariadb: use-after-free in SYS_REFCURSOR during FETCH operations [fedora-all]
bugzilla·2026-10-16·CVSS 9.9
CVE-2026-85748 [CRITICAL] CVE-2026-85748 mariadb12.3: mariadb: use-after-free in SYS_REFCURSOR during FETCH operations [fedora-all]
CVE-2026-85748 mariadb12.3: mariadb: use-after-free in SYS_REFCURSOR during FETCH operations [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
A use-after-free vulnerability was found in MariaDB's SYS_REFCURSOR handling during FETCH operations. An authenticated, low-privileged SQL user can trigger a use-after-free condition that potentially allows control over a virtual function call. When chained with a separate information-disclosure vulnerability, this can be used to modify Security_context::master_access to obtain FILE privileges and subsequently achieve operating-system command execution through UDF
Bugzilla
CVE-2026-85748 mariadb: mariadb: use-after-free in SYS_REFCURSOR during FETCH operations
bugzilla·2026-10-15·CVSS 9.9
CVE-2026-85748 [CRITICAL] CVE-2026-85748 mariadb: mariadb: use-after-free in SYS_REFCURSOR during FETCH operations
CVE-2026-85748 mariadb: mariadb: use-after-free in SYS_REFCURSOR during FETCH operations
A use-after-free vulnerability was found in MariaDB's SYS_REFCURSOR handling during FETCH operations. An authenticated, low-privileged SQL user can trigger a use-after-free condition that potentially allows control over a virtual function call. When chained with a separate information-disclosure vulnerability, this can be used to modify Security_context::master_access to obtain FILE privileges and subsequently achieve operating-system command execution through UDF loading.
The researcher reports successful exploitation against MariaDB 13.0.1-rc with ASLR, PIE, and Full RELRO enabled.
Reference: https://hackerone.com/reports/3856148
https://github.com/MariaDB/server/commit/91156c3de58762196605150ab3f756fe952592d1https://github.com/MariaDB/server/commit/9b075b2cb53338f67e7230cc585e02d2d34514edhttps://github.com/MariaDB/server/releases/tag/mariadb-12.3.3https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2https://github.com/MariaDB/server/security/advisories/GHSA-mv8g-9f7q-hprmhttps://jira.mariadb.org/browse/MDEV-40396https://jira.mariadb.org/browse/MDEV-40639
2026-10-16
Published