CVE-2026-85748

MariaDB server is a community developed fork of MySQL server. From 12.3.1 until 12.3.3 and 13.0.2, SYS_REFCURSOR handling is affected because cursor-array reallocation can leave stale references in routine contexts. A low-privileged attacker can open a large number of SYS_REFCURSORs and then fetch one to trigger a use-after-free that can enable remote code execution when combined with another vulnerability. This issue is fixed in versions 12.3.3 and 13.0.2.

• CWE-416

• https://github.com/MariaDB/server/commit/91156c3de58762196605150ab3f756fe952592d1Patch
• https://github.com/MariaDB/server/commit/9b075b2cb53338f67e7230cc585e02d2d34514edPatch
• https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3Release Notes
• https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2Release Notes
• https://github.com/MariaDB/server/security/advisories/GHSA-mv8g-9f7q-hprmVendor Advisory
• https://jira.mariadb.org/browse/MDEV-40396Issue Tracking
• https://jira.mariadb.org/browse/MDEV-40639Issue Tracking

Published

Oct 16, 2026

Last Modified

Oct 20, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-85738TREK is a collaborative travel planner. Prior to 3.4.0, the …6.3
• CVE-2026-8574Use after free in Core in Google Chrome on Windows prior to …8.3
• CVE-2026-85740LightRAG provides simple and fast retrieval-augmented genera…7.1
• CVE-2026-85745MariaDB server is a community developed fork of MySQL server…4.3
• CVE-2026-85746MariaDB server is a community developed fork of MySQL server…9.9
• CVE-2026-85747Distribution is a toolkit to pack, ship, store, and deliver …6.8
• CVE-2026-8575Use after free in UI in Google Chrome prior to 148.0.7778.16…8.3
• CVE-2026-85750Piwigo before v16.4.0 is vulnerable to arbitrary file read a…7.2
• CVE-2026-85751Mailu is a mail server distributed as a set of Docker images…9.8
• CVE-2026-85756SSH.NET is a Secure Shell (SSH) library for .NET. Prior to 2…7.5
• CVE-2026-8576Inappropriate implementation in CORS in Google Chrome on Lin…4.3
• CVE-2026-85769A flaw was found in libtpms, a library that provides softwar…6.5