CVE-2026-85969: Out-of-bounds write in Progress MarkLogic Server
Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain an out-of-bounds write vulnerability in certain language-processing functionality. A remote authenticated attacker could exploit this vulnerability to cause server instability or limited modification of data.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Progress MarkLogic Serverto a version that resolves this vulnerability.Fixed in 12.1.0 - Upgrade
Upgrade
Progress MarkLogic Serverto a version that resolves this vulnerability.Fixed in 11.3.7
Event History
Frequently Asked Questions
Which deployments are affected?
Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 are affected. The issue is in certain language-processing functionality.
Does an attacker need valid access to exploit this issue?
Yes. Exploitation requires a remote authenticated attacker, so an attacker must have credentials or an authenticated session with the necessary access.
What is the likely impact of successful exploitation?
Successful exploitation could cause server instability, creating an availability impact, or allow limited modification of data. The provided severity vector indicates no confidentiality impact.
What should be prioritized for remediation?
Upgrade affected 12.x deployments to 12.1.0 or later, and affected 11.x deployments to 11.3.7 or later. Prioritize systems where authenticated users can access the affected language-processing functionality.