CVE-2026-85748: MariaDB: Use-after-free with a large number of SYS_REFCURSOR's
MariaDB server is a community developed fork of MySQL server. From 12.3.1 until 12.3.3 and 13.0.2, SYSREFCURSOR handling is affected because cursor-array reallocation can leave stale references in routine contexts. A low-privileged attacker can open a large number of SYSREFCURSORs and then fetch one to trigger a use-after-free that can enable remote code execution when combined with another vulnerability. This issue is fixed in versions 12.3.3 and 13.0.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
MariaDB Serverto a version that resolves this vulnerability.Fixed in 12.3.3 - Upgrade
Upgrade
MariaDB Serverto a version that resolves this vulnerability.Fixed in 13.0.2
Event History
Frequently Asked Questions
Which deployments are affected?
MariaDB Server versions from 12.3.1 through 12.3.3, and version 13.0.2, are identified as affected. The issue is fixed in 12.3.3 and 13.0.2.
What access does an attacker need to trigger the flaw?
An attacker needs low-privileged access to the MariaDB server. They can open a large number of SYS_REFCURSORs and fetch one to trigger the use-after-free.
Does exploitation alone provide remote code execution?
The described use-after-free can enable remote code execution when combined with another vulnerability. The provided information does not state that this issue alone results in remote code execution.