TI-2026-75370 Aliases CVE-2026-85746

Out-of-bounds write in MariaDB ST_AsText on nested GeometryCollections

MEDIUM 45CWE-787Published 2026-10-16 · Updated 2026-10-16

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: Partial Red Hat: 1 fixed, 5 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-787 and the CVSS impact.

Summary

MariaDB server from 10.6.1 before 10.6.28, 10.11.1 before 10.11.19, 11.4.1 before 11.4.13, 11.8.1 before 11.8.9, 12.3.1 before 12.3.3 and 13.0.1 before 13.0.2 is affected. Recursive WKT serialization in ST_AsText does not reserve enough output buffer space for deeply nested GeometryCollections, so it writes past the buffer (CWE-787). A low-privileged remote attacker can submit a crafted GIS object to corrupt memory, which can potentially enable code execution together with another vulnerability.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, ST_AsText can write beyond an allocated output buffer when converting deeply nested GeometryCollections because recursive WKT serialization does not account for bytes consumed or reserve sufficient space. A low-privileged remote attacker can submit a specially crafted GIS object to corrupt memory and potentially achieve code execution when combined with another vulnerability. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.0097 62nd percentileScored 2026-11-07

Fix Partial server (MariaDB): 10.6.28, 10.11.19, 11.4.13 +3Red Hat: 1 advisoryRed Hat: 1 fixed, 5 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
MariaDB	server	10.6.1 to before 10.6.28; 10.11.1 to before 10.11.19; 11.4.1 to before 11.4.13; 11.8.1 to before 11.8.9; 12.3.1 to before 12.3.3; 13.0.1 to before 13.0.2	10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, 13.0.2	Patch available	CNA

server VendorMariaDB Affected 10.6.1 to before 10.6.28; 10.11.1 to before 10.11.19; 11.4.1 to before 11.4.13; 11.8.1 to before 11.8.9; 12.3.1 to before 12.3.3; 13.0.1 to before 13.0.2 Fixed in 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, 13.0.2 Patch available CNA

CPE configurations NVD · 2

CPE	Versions	Role	Vendor
cpe:2.3:a:mariadb:mariadb::::::::	10.6.1 to before 10.6.28; 10.11.1 to before 10.11.19; 11.4.1 to before 11.4.13; 11.8.1 to before 11.8.9; 12.3.1 to before 12.3.3	Vulnerable	MariaDB
cpe:2.3:a:mariadb:mariadb:13.0.1:::::::*	13.0.1	Vulnerable	MariaDB

cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:* Versions 10.6.1 to before 10.6.28; 10.11.1 to before 10.11.19; 11.4.1 to before 11.4.13; 11.8.1 to before 11.8.9; 12.3.1 to before 12.3.3 Vulnerable ·MariaDB
cpe:2.3:a:mariadb:mariadb:13.0.1:*:*:*:*:*:*:* Versions 13.0.1 Vulnerable ·MariaDB

Remediation

Upgrade MariaDB server to 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3 or 13.0.2, depending on the release branch in use. Red Hat fixes this in Red Hat Hardened Images through RHSA-2026:88864. Red Hat has no available plan for Red Hat Enterprise Linux 10, 7, 8 and 9 or Red Hat OpenStack Platform 13 (Queens).

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Fix · CNA server (MariaDB) Fixed in 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, 13.0.2

Red Hat 1 advisory

RHSA-2026:88864 Released 2026-10-23 · Red Hat rating Important
Red Hat Hardened Images RPMs Security Update
- Red Hat Hardened Images mariadb10.11-3:10.11.18-4.1.2.hum1@aarch64, mariadb10.11-3:10.11.18-4.1.2.hum1@s390x, mariadb10.11-3:10.11.18-4.1.2.hum1@src +47

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

Product	Status	Plan or fix
Red Hat Enterprise Linux 10	Affected	No fix yet
Red Hat Enterprise Linux 7	Affected	No fix yet
Red Hat Enterprise Linux 8	Affected	No fix yet
Red Hat Enterprise Linux 9	Affected	No fix yet
Red Hat OpenStack Platform 13 (Queens)	Affected	No fix yet
Red Hat Hardened Images	Fixed	RHSA-2026:88864

Not affected: 1 product

Red Hat Hardened Images

Timeline

2026-10-16 Threatist record created from CVE-2026-85746
2026-10-16 CISA SSVC decision points changed
2026-10-24 Fix available: RHSA-2026:88864 · Red Hat
2026-10-24 Fix available: Red Hat Hardened Images · Red Hat
2026-10-25 EPSS moved to the 50th–90th percentile
2026-10-26 CVSS score added · Red Hat

References

Patch 1

https://github.com/MariaDB/server/commit/5c04ca5524385356ff7cf84974a7d491974c1f85

Advisory 1

https://github.com/MariaDB/server/security/advisories/GHSA-8fvj-c57c-pggx

Other 7

TI-2023-11776 MariaDB v10.5 was discovered to contain a remote code execution (RCE) vulnerability via… CVSS 3.1CRITICAL 9.8
TI-2016-05707 Oracle MySQL through 5.5.52, 5.6.x through 5.6.33, and 5.7.x through 5.7.15; MariaDB… CVSS 3.0CRITICAL 9.8
TI-2022-00687 Infinite loop in BN_mod_sqrt() reachable when parsing certificates CVSS 3.1HIGH 7.5
TI-2014-00217 OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly… CVSS 3.1HIGH 7.4
TI-2014-00188 The dtls1_reassemble_fragment function in d1_both.c in OpenSSL before 0.9.8za, 1.0.0… CVSS 2.0MEDIUM 6.8
TI-2018-15259 zlib before 1.2.12 allows memory corruption when deflating (i.e., when compressing) if… CVSS 3.1HIGH 7.5

See all 429 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences