CVE-2026-85746

MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, ST_AsText can write beyond an allocated output buffer when converting deeply nested GeometryCollections because recursive WKT serialization does not account for bytes consumed or reserve sufficient space. A low-privileged remote attacker can submit a specially crafted GIS object to corrupt memory and potentially achieve code execution when combined with another vulnerability. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.

• CWE-787

• https://github.com/MariaDB/server/commit/5c04ca5524385356ff7cf84974a7d491974c1f85Patch
• https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19Release Notes
• https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28Release Notes
• https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13Release Notes
• https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9Release Notes
• https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3Release Notes
• https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2Release Notes
• https://github.com/MariaDB/server/security/advisories/GHSA-8fvj-c57c-pggxVendor Advisory
• https://jira.mariadb.org/browse/MDEV-40329Issue Tracking

Published

Oct 16, 2026

Last Modified

Oct 20, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-85733FrankenPHP is a modern application server for PHP. Prior to …5.3
• CVE-2026-85734LightRAG provides simple and fast retrieval-augmented genera…9.1
• CVE-2026-85738TREK is a collaborative travel planner. Prior to 3.4.0, the …6.3
• CVE-2026-8574Use after free in Core in Google Chrome on Windows prior to …8.3
• CVE-2026-85740LightRAG provides simple and fast retrieval-augmented genera…7.1
• CVE-2026-85745MariaDB server is a community developed fork of MySQL server…4.3
• CVE-2026-85747Distribution is a toolkit to pack, ship, store, and deliver …6.8
• CVE-2026-85748MariaDB server is a community developed fork of MySQL server…9.9
• CVE-2026-8575Use after free in UI in Google Chrome prior to 148.0.7778.16…8.3
• CVE-2026-85750Piwigo before v16.4.0 is vulnerable to arbitrary file read a…7.2
• CVE-2026-85751Mailu is a mail server distributed as a set of Docker images…9.8
• CVE-2026-85756SSH.NET is a Secure Shell (SSH) library for .NET. Prior to 2…7.5