CVSS 9.9: MariaDB 10.6-13.0 GIS Flaw Enables Remote Code Execution via Nested Geometry

A critical buffer overflow vulnerability in MariaDB Server exposes database environments to potential remote code execution. The National Vulnerability Database assigns CVE-2026-85746 a CVSS score of 9.9, indicating severe risk. The flaw resides in the ST_AsText function, which converts geographic information system objects into text. When processing deeply nested GeometryCollections, the function fails to reserve sufficient space for the output. This oversight allows memory corruption when a remote attacker submits a specially crafted GIS object.

Which MariaDB versions are affected by this flaw?

The vulnerability impacts a wide range of MariaDB Server releases. Affected versions include all builds from 10.6.1 up to, but not including, 10.6.28. It also covers releases from 10.11.1 through 10.11.18, 11.4.1 through 11.4.12, and 11.8.1 through 11.8.8. Additionally, versions 12.3.1 and 12.3.2, as well as 13.0.1, are vulnerable. The issue stems from recursive Well-Known Text serialization that does not account for consumed bytes.

How does the technical exploit work?

The root cause is identified as CWE-787, an out-of-bounds write. The ST_AsText function processes GeometryCollections recursively to generate text representations. During this process, the code does not track the number of bytes consumed or allocate adequate buffer space. A low-privileged remote attacker can submit a malicious GIS object designed to trigger this overflow. This action writes data beyond the allocated output buffer, corrupting adjacent memory. According to the source material, this memory corruption could potentially allow code execution when combined with another vulnerability.

Are patches available for affected systems?

Yes, fixes have been released for all affected version lines. The vulnerability is resolved in MariaDB Server version 10.6.28. For the 10.11 branch, the fix is in version 10.11.19. Users of the 11.4 branch should update to version 11.4.13. The 11.8 branch requires an update to version 11.8.9. Finally, version 12.3.3 and version 13.0.2 contain the necessary corrections. These updates address the buffer allocation logic in the GIS conversion routines.

What is the severity assessment?

The National Vulnerability Database rates CVE-2026-85746 as critical. The CVSS score of 9.9 reflects the high impact of remote code execution potential. Although the attacker requires low privileges, the ability to submit crafted GIS objects remotely makes exploitation feasible. The weakness is classified under CWE-787. This indicates a fundamental failure in memory management within the ST_AsText function. Organizations relying on older MariaDB versions face immediate exposure if they process untrusted geographic data.

Detection notes

Security operations teams should monitor database logs for unexpected process crashes or segmentation faults following GIS queries. Look for spikes in CPU usage or memory anomalies when ST_AsText is invoked on complex geometry data. Check for unauthorized changes to system files or new network connections originating from the database server process. If suspicious activity is detected, isolate the affected server from the network immediately. Disable remote access to the database instance to prevent further exploitation. Review recent queries for malformed GeometryCollections that may indicate an attack attempt.

Background: National Vulnerability Database

The National Vulnerability Database is the U.S. government’s repository of security flaws in software and hardware. It assigns unique identifiers to each issue, allowing organizations to track, prioritize, and remediate risks using standardized references rather than vague descriptions.

Read the full guide: National Vulnerability Database: Meaning, Structure, and Daily Use

What to do and how to stay safe: MariaDB

• Audit all MariaDB Server instances to identify versions prior to the patched releases listed in the advisory.
• Apply the latest security updates for your specific MariaDB branch as soon as possible.
• Restrict remote access to the database server to trusted networks and authenticated users only.
• Monitor database logs for signs of memory corruption or unusual GIS query patterns.

Step-by-step guide: Patch Management Checklist: Secure Systems Without Breaking Them

General security guidance from the Firewall Scoop newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is CVE-2026-85746?

It is a critical buffer overflow vulnerability in MariaDB Server that allows remote attackers to corrupt memory via crafted GIS objects.

Which function is vulnerable?

The ST_AsText function is vulnerable when converting deeply nested GeometryCollections due to insufficient buffer allocation.

Is there a fix?

Yes, the issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.