CVE-2026-85968: Out-of-bounds read in Progress MarkLogic Server
Progress MarkLogic Server 12.x releases before 12.1.0 contain an out-of-bounds read vulnerability in certain query-processing functionality. A remote authenticated attacker could exploit this vulnerability to cause server instability or disclose limited information from process memory.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Progress MarkLogic Serverto a version that resolves this vulnerability.Fixed in 12.1.0
Event History
Frequently Asked Questions
Who is exposed to exploitation?
Instances running Progress MarkLogic Server 12.x before 12.1.0 are affected. Exploitation can be performed remotely, but the attacker must be authenticated.
What can an attacker do with this flaw?
An authenticated remote attacker may cause server instability, affecting availability. They may also disclose limited information from process memory.
Is authentication required to exploit the issue?
Yes. The attack vector is network-accessible, but exploitation requires low-level privileges; unauthenticated remote exploitation is not indicated by the provided information.
Which version resolves the vulnerability?
The issue affects 12.x releases before 12.1.0. Updating to 12.1.0 or later removes the affected version range described here.