Vulnerability Details CVE-2026-85745
MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, ST_Area reads beyond the allocated buffer when processing invalid WKB for a MultiPolygon because the multi-polygon parser advances past a nested geometry header without first verifying enough input remains. A low-privileged remote attacker can supply malformed spatial data to disclose memory useful for bypassing ASLR as part of a multi-vulnerability chain. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.004
EPSS Ranking 27.5%
CVSS Severity
CVSS v3 Score 4.3
Products affected by CVE-2026-85745
-
cpe:2.3:a:mariadb:mariadb:10.11.1
-
cpe:2.3:a:mariadb:mariadb:10.11.10
-
cpe:2.3:a:mariadb:mariadb:10.11.11
-
cpe:2.3:a:mariadb:mariadb:10.11.12
-
cpe:2.3:a:mariadb:mariadb:10.11.13
-
cpe:2.3:a:mariadb:mariadb:10.11.14
-
cpe:2.3:a:mariadb:mariadb:10.11.15
-
cpe:2.3:a:mariadb:mariadb:10.11.16
-
cpe:2.3:a:mariadb:mariadb:10.11.17
-
cpe:2.3:a:mariadb:mariadb:10.11.18
-
cpe:2.3:a:mariadb:mariadb:10.11.2
-
cpe:2.3:a:mariadb:mariadb:10.11.3
-
cpe:2.3:a:mariadb:mariadb:10.11.4
-
cpe:2.3:a:mariadb:mariadb:10.11.5
-
cpe:2.3:a:mariadb:mariadb:10.11.6
-
cpe:2.3:a:mariadb:mariadb:10.11.7
-
cpe:2.3:a:mariadb:mariadb:10.11.8
-
cpe:2.3:a:mariadb:mariadb:10.11.9
-
cpe:2.3:a:mariadb:mariadb:10.6.1
-
cpe:2.3:a:mariadb:mariadb:10.6.10
-
cpe:2.3:a:mariadb:mariadb:10.6.11
-
cpe:2.3:a:mariadb:mariadb:10.6.12
-
cpe:2.3:a:mariadb:mariadb:10.6.13
-
cpe:2.3:a:mariadb:mariadb:10.6.14
-
cpe:2.3:a:mariadb:mariadb:10.6.15
-
cpe:2.3:a:mariadb:mariadb:10.6.16
-
cpe:2.3:a:mariadb:mariadb:10.6.17
-
cpe:2.3:a:mariadb:mariadb:10.6.18
-
cpe:2.3:a:mariadb:mariadb:10.6.19
-
cpe:2.3:a:mariadb:mariadb:10.6.2
-
cpe:2.3:a:mariadb:mariadb:10.6.20
-
cpe:2.3:a:mariadb:mariadb:10.6.21
-
cpe:2.3:a:mariadb:mariadb:10.6.22
-
cpe:2.3:a:mariadb:mariadb:10.6.23
-
cpe:2.3:a:mariadb:mariadb:10.6.24
-
cpe:2.3:a:mariadb:mariadb:10.6.25
-
cpe:2.3:a:mariadb:mariadb:10.6.26
-
cpe:2.3:a:mariadb:mariadb:10.6.27
-
cpe:2.3:a:mariadb:mariadb:10.6.3
-
cpe:2.3:a:mariadb:mariadb:10.6.4
-
cpe:2.3:a:mariadb:mariadb:10.6.5
-
cpe:2.3:a:mariadb:mariadb:10.6.6
-
cpe:2.3:a:mariadb:mariadb:10.6.7
-
cpe:2.3:a:mariadb:mariadb:10.6.8
-
cpe:2.3:a:mariadb:mariadb:10.6.9
-
cpe:2.3:a:mariadb:mariadb:11.4.1
-
cpe:2.3:a:mariadb:mariadb:11.4.10
-
cpe:2.3:a:mariadb:mariadb:11.4.11
-
cpe:2.3:a:mariadb:mariadb:11.4.12
-
cpe:2.3:a:mariadb:mariadb:11.4.2
-
cpe:2.3:a:mariadb:mariadb:11.4.3
-
cpe:2.3:a:mariadb:mariadb:11.4.4
-
cpe:2.3:a:mariadb:mariadb:11.4.5
-
cpe:2.3:a:mariadb:mariadb:11.4.6
-
cpe:2.3:a:mariadb:mariadb:11.4.7
-
cpe:2.3:a:mariadb:mariadb:11.4.8
-
cpe:2.3:a:mariadb:mariadb:11.4.9
-
cpe:2.3:a:mariadb:mariadb:11.8.1
-
cpe:2.3:a:mariadb:mariadb:11.8.2
-
cpe:2.3:a:mariadb:mariadb:11.8.3
-
cpe:2.3:a:mariadb:mariadb:11.8.4
-
cpe:2.3:a:mariadb:mariadb:11.8.5
-
cpe:2.3:a:mariadb:mariadb:11.8.6
-
cpe:2.3:a:mariadb:mariadb:11.8.7
-
cpe:2.3:a:mariadb:mariadb:11.8.8
-
cpe:2.3:a:mariadb:mariadb:12.3.1
-
cpe:2.3:a:mariadb:mariadb:12.3.2
-
cpe:2.3:a:mariadb:mariadb:13.0.1