CVE-2026-85745

MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, ST_Area reads beyond the allocated buffer when processing invalid WKB for a MultiPolygon because the multi-polygon parser advances past a nested geometry header without first verifying enough input remains. A low-privileged remote attacker can supply malformed spatial data to disclose memory useful for bypassing ASLR as part of a multi-vulnerability chain. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.

• CWE-126

• https://github.com/MariaDB/server/commit/2bf355e361db85153fdfba7b8a0f0d114d6a26cePatch
• https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19Release Notes
• https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28Release Notes
• https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13Release Notes
• https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9Release Notes
• https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3Release Notes
• https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2Release Notes
• https://github.com/MariaDB/server/security/advisories/GHSA-p7v9-24h4-mch8Vendor Advisory
• https://jira.mariadb.org/browse/MDEV-40328Issue Tracking

Published

Oct 16, 2026

Last Modified

Oct 20, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-85732oras-go is a Go library for managing OCI artifacts. Prior to…4.7
• CVE-2026-85733FrankenPHP is a modern application server for PHP. Prior to …5.3
• CVE-2026-85734LightRAG provides simple and fast retrieval-augmented genera…9.1
• CVE-2026-85738TREK is a collaborative travel planner. Prior to 3.4.0, the …6.3
• CVE-2026-8574Use after free in Core in Google Chrome on Windows prior to …8.3
• CVE-2026-85740LightRAG provides simple and fast retrieval-augmented genera…7.1
• CVE-2026-85746MariaDB server is a community developed fork of MySQL server…9.9
• CVE-2026-85747Distribution is a toolkit to pack, ship, store, and deliver …6.8
• CVE-2026-85748MariaDB server is a community developed fork of MySQL server…9.9
• CVE-2026-8575Use after free in UI in Google Chrome prior to 148.0.7778.16…8.3
• CVE-2026-85750Piwigo before v16.4.0 is vulnerable to arbitrary file read a…7.2
• CVE-2026-85751Mailu is a mail server distributed as a set of Docker images…9.8