CVE-2026-85746

Status: AnalyzedCritical (9.9)—

Severity9.9Critical · CVSS 3.1

Exploitation probability0.63 %higher than 49% of CVEs

Active exploitationNonot in the CISA catalog

Public exploitNot knownno public code found

News and reports on Orbitaley

MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, ST_AsText can write beyond an allocated output buffer when converting deeply nested GeometryCollections because recursive WKT serialization does not account for bytes consumed or reserve sufficient space. A low-privileged remote attacker can submit a specially crafted GIS object to corrupt memory and potentially achieve code execution when combined with another vulnerability. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.

CVSS

Base score: 9.9
Version: 3.1
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Exploitation probability (EPSS)

Probability of exploitation in the next 30 days: 0.63 %
Percentile among all scored CVEs: 49
Score date: 10/20/2026

EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).

ATT&CK techniques

How this vulnerability is exploited and what the attacker gains, in MITRE ATT&CK terms.

ExploitationT1210 Exploitation of Remote Serviceslateral movement90 %

Vector AV:N/PR:L/UI:N indica red con privilegios bajos; la corrupción de memoria en ST_AsText permite posible ejecución de código, pero solo combinada con otra vulnerabilidad.

Inferred by our analysis agent from the official description, CVSS vector and CWE, and checked by a supervisor. May contain errors.

ATT&CK mitigations that cover these techniques

Vulnerability Scanning Threat Intelligence Program Privileged Account Management Network Segmentation Disable or Remove Feature or Program Application Isolation and Sandboxing

Affected technologies (1)

Mariadb — Mariadb

CWEs

CWE-787

References

Show 9 references

Raw JSON (NVD)

Show

{
  "id": "CVE-2026-85746",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-85746",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-10-16T16:49:55.618818Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 9.9,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 6,
        "exploitabilityScore": 3.1
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "MariaDB",
          "product": "server",
          "versions": [
            {
              "status": "affected",
              "version": ">= 10.6.1, < 10.6.28"
            },
            {
              "status": "affected",
              "version": ">= 10.11.1, < 10.11.19"
            },
            {
              "status": "affected",
              "version": ">= 11.4.1, < 11.4.13"
            },
            {
              "status": "affected",
              "version": ">= 11.8.1, < 11.8.9"
            },
            {
              "status": "affected",
              "version": ">= 12.3.1, < 12.3.3"
            },
            {
              "status": "affected",
              "version": ">= 13.0.1, < 13.0.2"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-10-16T17:17:51.167",
  "references": [
    {
      "url": "https://github.com/MariaDB/server/commit/5c04ca5524385356ff7cf84974a7d491974c1f85",
      "tags": [
        "Patch"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19",
      "tags": [
        "Release Notes"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28",
      "tags": [
        "Release Notes"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13",
      "tags": [
        "Release Notes"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9",
      "tags": [
        "Release Notes"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3",
      "tags": [
        "Release Notes"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2",
      "tags": [
        "Release Notes"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/MariaDB/server/security/advisories/GHSA-8fvj-c57c-pggx",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://jira.mariadb.org/browse/MDEV-40329",
      "tags": [
        "Issue Tracking"
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-787"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, ST_AsText can write beyond an allocated output buffer when converting deeply nested GeometryCollections because recursive WKT serialization does not account for bytes consumed or reserve sufficient space. A low-privileged remote attacker can submit a specially crafted GIS object to corrupt memory and potentially achieve code execution when combined with another vulnerability. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2."
    }
  ],
  "lastModified": "2026-10-20T15:33:00.870",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6A6667AA-6A82-49E2-894B-318569872468",
              "versionEndExcluding": "10.6.28",
              "versionStartIncluding": "10.6.1"
            },
            {
              "criteria": "cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C18A44B6-CEEF-47D7-9D60-04E6EBAFC785",
              "versionEndExcluding": "10.11.19",
              "versionStartIncluding": "10.11.1"
            },
            {
              "criteria": "cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "47070DA5-F754-4FE1-957A-375C39D9029E",
              "versionEndExcluding": "11.4.13",
              "versionStartIncluding": "11.4.1"
            },
            {
              "criteria": "cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "39AD11EC-57BE-4D2B-9A7C-E667E23A6940",
              "versionEndExcluding": "11.8.9",
              "versionStartIncluding": "11.8.1"
            },
            {
              "criteria": "cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E6988F1C-2D11-431B-BBE4-3AA8483627C8",
              "versionEndExcluding": "12.3.3",
              "versionStartIncluding": "12.3.1"
            },
            {
              "criteria": "cpe:2.3:a:mariadb:mariadb:13.0.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E46FBE57-06D5-489E-9ECE-333F5F9AFD06"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security-advisories@github.com"
}