CVE-2026-85745·MariaDB vulnerability
MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, ST_Area reads beyond the allocated buffer when processing invalid WKB for a MultiPolygon because the multi-polygon parser advances past a nested geometry header without first verifying enough input remains. A low-privileged remote attacker can supply malformed spatial data to disclose memory useful for bypassing ASLR as part of a multi-vulnerability chain. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.
- Severity
- medium
- Software
- MariaDB
- Fixed in
- 12.3.3
- Published
How likely is exploitation
FIRST's Exploit Prediction Scoring System puts the probability of this CVE being exploited in the next 30 days at 0.53% — higher than 45% of all published CVEs. EPSS is an independent forecast of exploitation, not a severity rating: it says nothing about how much damage a successful attack does, which is what a CVSS score measures.
Affected versions
From: 12.3.1
Until: 12.3.3
Fixed in: 12.3.3
How to fix this CVE
Update MariaDB to version 11.8.9 or later to patch a buffer over-read vulnerability in the ST_Area function when processing malformed spatial WKB data. This vulnerability allows low-privileged attackers to leak memory that could aid in ASLR bypass attacks. Immediate patching is recommended for systems exposed to untrusted spatial data inputs.
sudo dnf update mariadb-serverDefensia detects this vulnerability
How to check if you are affected
- Check installed MariaDB version: mysql --version or mysqld --version
- Query the MariaDB server for version: SELECT @@version;
- Verify if spatial function queries are logged: grep -i 'ST_Area\|ST_GeomFromWKB' /var/log/mysql/*.log or check the error log for buffer-related errors
- After update, confirm new version: mysql --version and SELECT @@version; should show 11.8.9 or higher
FAQ
What is CVE-2026-85745?
A buffer over-read vulnerability in MariaDB's ST_Area function that occurs when processing invalid WKB (Well-Known Binary) data for MultiPolygon geometries. An authenticated attacker can exploit this to leak sensitive memory contents for ASLR bypass attacks.
Is CVE-2026-85745 being actively exploited?
No, there are currently no known active exploits in the wild, and this vulnerability is not listed on the CISA KEV catalog.
What versions of MariaDB are affected by CVE-2026-85745?
MariaDB versions from 10.6.1 up to (but not including) 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2 are vulnerable. The fix is available in 11.8.9 and later versions in each respective branch.
How do I check if my server is vulnerable to CVE-2026-85745?
Run: mysql --version or connect to your MariaDB instance and execute SELECT @@version; If the version is below 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, or 13.0.2 (depending on your branch), your system is vulnerable.
Does Defensia detect CVE-2026-85745?
Yes — Defensia's CVE advisory scanner compares installed package versions against the NVD database. If MariaDB is installed on a monitored server, CVE-2026-85745 will appear in your dashboard with remediation steps.
Related MariaDB CVEs
References
- https://github.com/MariaDB/server/commit/2bf355e361db85153fdfba7b8a0f0d114d6a26ce
- https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19
- https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28
- https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13
- https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9
Track CVEs across your fleet automatically
Defensia scans your Linux servers and tells you exactly which ones are running vulnerable versions — including CVE-2026-85745. Free for 1 server.
Get started free