Memory Corruption Vulnerability in MariaDB Server Affecting Multiple Versions
CVE-2026-85746
9.9CRITICAL
What is CVE-2026-85746?
A memory corruption vulnerability exists in the MariaDB Server, where the ST_AsText function can write beyond an allocated output buffer due to inadequate handling of recursive WKT serialization for complex GeometryCollections. This flaw can be exploited by a low-privileged remote attacker who submits specially crafted GIS objects, potentially allowing for memory corruption and escalating to code execution when combined with other vulnerabilities. The issue has been addressed in the latest versions of MariaDB Server.
Affected Version(s)
server >= 10.6.1, < 10.6.28 < 10.6.1, 10.6.28
server >= 10.11.1, < 10.11.19 < 10.11.1, 10.11.19
server >= 11.4.1, < 11.4.13 < 11.4.1, 11.4.13