CVE-2026-85748
Noticias y reportajes en Orbitaley
El servidor MariaDB es una bifurcación de MySQL server desarrollada por la comunidad. Desde la versión 12.3.1 hasta la 12.3.3 y la 13.0.2, el manejo de SYS_REFCURSOR se ve afectado, ya que la reasignación del array de cursores puede dejar referencias obsoletas en los contextos de rutinas. Un atacante con pocos privilegios puede abrir un gran número de SYS_REFCURSOR y, a continuación, recuperar uno para provocar un use-after-free (uso de memoria liberada), lo que puede permitir la ejecución remota de código cuando se combina con otra vulnerabilidad. Este fallo se ha corregido en las versiones 12.3.3 y 13.0.2.
Traducción automática del texto original de NVD (en inglés).
CVSS
- Puntuación base
- 9.9
- Versión
- 3.1
- Vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días
- 0.55 %
- Percentil entre todas las CVEs puntuadas
- 45
- Fecha de la puntuación
- 20/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Técnicas ATT&CK
Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.
- Explotación
T1210Exploitation of Remote Serviceslateral movement85 % - Impacto principal
T1059Command and Scripting Interpreterexecution55 %
El vector AV:N/PR:L/UI:N exige credenciales bajas y red; el use-after-free en SYS_REFCURSOR puede permitir RCE si se combina con otra vulnerabilidad.
Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.
Mitigaciones ATT&CK que cubren estas técnicas
Tecnologías afectadas (1)
CWE
- CWE-416
Referencias
Mostrar las 7 referencias
- https://github.com/MariaDB/server/commit/91156c3de58762196605150ab3f756fe952592d1
- https://github.com/MariaDB/server/commit/9b075b2cb53338f67e7230cc585e02d2d34514ed
- https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3
- https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2
- https://github.com/MariaDB/server/security/advisories/GHSA-mv8g-9f7q-hprm
- https://jira.mariadb.org/browse/MDEV-40396
- https://jira.mariadb.org/browse/MDEV-40639
JSON original (NVD)
Mostrar
{
"id": "CVE-2026-85748",
"cveTags": [],
"metrics": {
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2026-85748",
"role": "CISA Coordinator",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "total"
}
],
"version": "2.0.3",
"timestamp": "2026-10-16T16:54:30.361781Z"
}
}
],
"cvssMetricV31": [
{
"type": "Secondary",
"source": "security-advisories@github.com",
"cvssData": {
"scope": "CHANGED",
"version": "3.1",
"baseScore": 9.9,
"attackVector": "NETWORK",
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"integrityImpact": "HIGH",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "HIGH",
"privilegesRequired": "LOW",
"confidentialityImpact": "HIGH"
},
"impactScore": 6,
"exploitabilityScore": 3.1
}
]
},
"affected": [
{
"source": "security-advisories@github.com",
"affectedData": [
{
"vendor": "MariaDB",
"product": "server",
"versions": [
{
"status": "affected",
"version": ">= 12.3.1, < 12.3.3"
},
{
"status": "affected",
"version": ">= 13.0.1, < 13.0.2"
}
]
}
]
}
],
"published": "2026-10-16T17:17:51.303",
"references": [
{
"url": "https://github.com/MariaDB/server/commit/91156c3de58762196605150ab3f756fe952592d1",
"tags": [
"Patch"
],
"source": "security-advisories@github.com"
},
{
"url": "https://github.com/MariaDB/server/commit/9b075b2cb53338f67e7230cc585e02d2d34514ed",
"tags": [
"Patch"
],
"source": "security-advisories@github.com"
},
{
"url": "https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3",
"tags": [
"Release Notes"
],
"source": "security-advisories@github.com"
},
{
"url": "https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2",
"tags": [
"Release Notes"
],
"source": "security-advisories@github.com"
},
{
"url": "https://github.com/MariaDB/server/security/advisories/GHSA-mv8g-9f7q-hprm",
"tags": [
"Vendor Advisory"
],
"source": "security-advisories@github.com"
},
{
"url": "https://jira.mariadb.org/browse/MDEV-40396",
"tags": [
"Issue Tracking"
],
"source": "security-advisories@github.com"
},
{
"url": "https://jira.mariadb.org/browse/MDEV-40639",
"tags": [
"Issue Tracking"
],
"source": "security-advisories@github.com"
}
],
"vulnStatus": "Analyzed",
"weaknesses": [
{
"type": "Primary",
"source": "security-advisories@github.com",
"description": [
{
"lang": "en",
"value": "CWE-416"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "MariaDB server is a community developed fork of MySQL server. From 12.3.1 until 12.3.3 and 13.0.2, SYS_REFCURSOR handling is affected because cursor-array reallocation can leave stale references in routine contexts. A low-privileged attacker can open a large number of SYS_REFCURSORs and then fetch one to trigger a use-after-free that can enable remote code execution when combined with another vulnerability. This issue is fixed in versions 12.3.3 and 13.0.2."
}
],
"lastModified": "2026-10-20T15:32:54.420",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "E6988F1C-2D11-431B-BBE4-3AA8483627C8",
"versionEndExcluding": "12.3.3",
"versionStartIncluding": "12.3.1"
},
{
"criteria": "cpe:2.3:a:mariadb:mariadb:13.0.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "E46FBE57-06D5-489E-9ECE-333F5F9AFD06"
}
],
"operator": "OR"
}
]
}
],
"sourceIdentifier": "security-advisories@github.com"
}