Key points
- MariaDB Server versions 10.6 through 13.0 contain a buffer overflow in ST_AsText processing.
- The vulnerability is rated CVSS 9.9 Critical by the National Vulnerability Database.
- Patches are available for all affected release branches starting from specific minor versions.
MariaDB Server contains a critical buffer overflow vulnerability in its geographic information system functionality. The flaw allows remote attackers to potentially execute code by submitting specially crafted data objects to the database server.
What happened
The National Vulnerability Database recorded CVE-2026-85746 with a CVSS score of 9.9. The issue stems from the ST_AsText function within MariaDB Server, which converts geometry data into Well-Known Text format. According to the advisory, the recursive serialization process fails to account for bytes consumed or reserve sufficient space when handling deeply nested GeometryCollections. This miscalculation causes the function to write beyond the allocated output buffer.
The vulnerability affects specific ranges across multiple MariaDB Server branches. Affected versions include MariaDB Server 10.6.1 through 10.6.27, 10.11.1 through 10.11.18, 11.4.1 through 11.4.12, 11.8.1 through 11.8.8, 12.3.0 through 12.3.2, and 13.0.0 through 13.0.1. The root cause is classified under CWE-787, which relates to out-of-bounds write errors. The flaw is inherent in the community-developed fork of MySQL server software.
Why it matters
A low-privileged remote attacker can exploit this weakness by submitting a specially crafted GIS object to the server. This action corrupts memory, which can potentially lead to arbitrary code execution. The advisory notes that achieving code execution may require combining this vulnerability with another security flaw. The high severity rating reflects the ease of remote exploitation and the significant impact of memory corruption.
Organisations using MariaDB Server for spatial data storage are directly exposed. The function involved is standard for converting geometric data, meaning many applications may trigger the flaw inadvertently. The lack of sufficient space reservation during recursive processing makes the buffer overflow predictable for an attacker with network access to the database service.
What happens next
The vendor has released patches for all affected branches. Administrators should update to MariaDB Server 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, or 13.0.2. These specific versions contain the fix for the buffer overflow. Users must verify their current version against the affected list provided by the NVD. Immediate application of the update is recommended to mitigate the risk of remote exploitation.
Patch priority
Security teams should prioritise systems exposed to untrusted network input. Identify databases that process GIS data from external applications or APIs first. Before applying the update, create full backups of the database instances to prevent data loss during the upgrade process. Test the patched version in a non-production environment to ensure compatibility with existing spatial queries and application logic. Roll out the fix to production systems in stages, monitoring for errors after each batch. If immediate patching is not possible, restrict network access to the database port to trusted internal networks only.
Background: Remote code execution vulnerabilities
Remote code execution often occurs because developers trust user input without validation, fail to restrict file permissions, or neglect to update dependencies. Fix these errors by enforcing strict input sanitisation, applying least-privilege principles, and integrating automated security checks into your secure software development lifecycle to prevent arbitrary command execution.
Read the full guide: Seven Configuration Mistakes That Allow Remote Code Execution
What to do and how to stay safe: MariaDB
- Inventory all MariaDB Server instances to identify those running affected versions listed in the NVD record.
- Review firewall rules to ensure the database port is not accessible from public or untrusted networks.
- Monitor server logs for unusual GIS query patterns or failed connection attempts that could indicate exploitation attempts.
- Plan to apply the vendor patch during a maintenance window after validating it in a test environment.
Step-by-step guide: Patch Management: Definition, Purpose and Operational Reality
General security guidance from the AppSec Scoop newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which specific MariaDB versions are vulnerable to CVE-2026-85746?
Versions 10.6.1 to 10.6.27, 10.11.1 to 10.11.18, 11.4.1 to 11.4.12, 11.8.1 to 11.8.8, 12.3.0 to 12.3.2, and 13.0.0 to 13.0.1 are affected.
Is there a patch available for this vulnerability?
Yes, fixes are available in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.
What is the severity of this vulnerability?
The National Vulnerability Database rates it as Critical with a CVSS score of 9.9.
