CVE-2026-85965: Use-after-free in Progress MarkLogic Server JavaScript engine integration
Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain memory-safety defects in the JavaScript engine integration that could result in memory corruption, controlled process failure, or server instability.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Progress MarkLogic Serverto a version that resolves this vulnerability.Fixed in 12.1.0 - Upgrade
Upgrade
Progress MarkLogic Serverto a version that resolves this vulnerability.Fixed in 11.3.7
Event History
Frequently Asked Questions
Which deployments are affected and which versions include the fix?
Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 are affected. Upgrading to 12.1.0 or later on the 12.x line, or 11.3.7 or later on the 11.x line, addresses the affected version ranges.
What level of access does an attacker need to exploit this issue?
The supplied vector indicates network reachability, high privileges, and high attack complexity are required. No user interaction is required.