{"id":"CVE-2026-85746","published":"2026-10-16T17:17:51.167","lastModified":"2026-10-16T18:19:16.007","description":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, ST_AsText can write beyond an allocated output buffer when converting deeply nested GeometryCollections because recursive WKT serialization does not account for bytes consumed or reserve sufficient space. A low-privileged remote attacker can submit a specially crafted GIS object to corrupt memory and potentially achieve code execution when combined with another vulnerability. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.","cvssScore":9.9,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cwes":["CWE-787"],"vendors":[],"products":[],"references":[{"url":"https://github.com/MariaDB/server/commit/5c04ca5524385356ff7cf84974a7d491974c1f85","tags":[]},{"url":"https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19","tags":[]},{"url":"https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28","tags":[]},{"url":"https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13","tags":[]},{"url":"https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9","tags":[]},{"url":"https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3","tags":[]},{"url":"https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2","tags":[]},{"url":"https://github.com/MariaDB/server/security/advisories/GHSA-8fvj-c57c-pggx","tags":[]},{"url":"https://jira.mariadb.org/browse/MDEV-40329","tags":[]}],"exploitRefs":[{"url":"https://github.com/MariaDB/server/commit/5c04ca5524385356ff7cf84974a7d491974c1f85","tags":[]},{"url":"https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19","tags":[]},{"url":"https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28","tags":[]},{"url":"https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13","tags":[]},{"url":"https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9","tags":[]},{"url":"https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3","tags":[]},{"url":"https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2","tags":[]},{"url":"https://github.com/MariaDB/server/security/advisories/GHSA-8fvj-c57c-pggx","tags":[]}],"hasPoc":true,"ai":{"summary":"A buffer overflow vulnerability in MariaDB's ST_AsText function allows attackers to write beyond allocated memory when processing deeply nested GeometryCollections, potentially leading to remote code execution when combined with other vulnerabilities.","exploitability":"Exploitation requires a low-privileged remote attacker who can submit crafted GIS objects; the attack is moderately difficult as it requires combining this vulnerability with another to achieve full RCE, but the primitive is well-suited for exploitation.","blast_radius":"The vulnerability affects MariaDB installations across multiple major versions (10.6.x through 13.0.x) and could impact any application using GIS functions, particularly those handling spatial data from untrusted sources.","remediation":"Upgrade to MariaDB 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, or 13.0.2 immediately.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["rce","buffer-overflow","gis","database"],"model":"garnet-coder","analyzedAt":"2026-10-17T08:45:17.971Z"}}