CVE-2026-85745: MariaDB: Out-of-bound buffer read on in `ST_Area` of a multipolygon.
MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, STArea reads beyond the allocated buffer when processing invalid WKB for a MultiPolygon because the multi-polygon parser advances past a nested geometry header without first verifying enough input remains. A low-privileged remote attacker can supply malformed spatial data to disclose memory useful for bypassing ASLR as part of a multi-vulnerability chain. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
MariaDBto a version that resolves this vulnerability.Fixed in 10.6.28 - Upgrade
Upgrade
MariaDBto a version that resolves this vulnerability.Fixed in 10.11.19 - Upgrade
Upgrade
MariaDBto a version that resolves this vulnerability.Fixed in 11.4.13 - Upgrade
Upgrade
MariaDBto a version that resolves this vulnerability.Fixed in 11.8.9 - Upgrade
Upgrade
MariaDBto a version that resolves this vulnerability.Fixed in 12.3.3 - Upgrade
Upgrade
MariaDBto a version that resolves this vulnerability.Fixed in 13.0.2
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
An attacker must be able to connect remotely to the MariaDB server and operate with low-privileged credentials. They also need a path to submit malformed WKB spatial data that is processed as a MultiPolygon by ST_Area.
What is the practical impact?
The out-of-bounds read can disclose server memory. The disclosed memory may help bypass ASLR, but the issue is described as useful as part of a multi-vulnerability chain rather than providing direct integrity or availability impact.
Which releases contain the fix?
The issue is fixed in MariaDB 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2. Affected versions begin at 10.6.1 and include releases before the listed fixed versions in the affected release lines.