CVE-2026-85746
MariaDB: Out-of-bound buffer write on in `ST_AsText` of nested GeometryCollections
MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, ST_AsText can write beyond an allocated output buffer when converting deeply nested GeometryCollections because recursive WKT serialization does not account for bytes consumed or reserve sufficient space. A low-privileged remote attacker can submit a specially crafted GIS object to corrupt memory and potentially achieve code execution when combined with another vulnerability. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
MariaDB: Out-of-bound buffer write on in `ST_AsText` of nested GeometryCollections
MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, ST_AsText can write beyond an allocated output buffer when converting deeply nested GeometryCollections because recursive WKT serialization does not account for bytes consumed or reserve sufficient space. A low-privileged remote attacker can submit a specially crafted GIS object to corrupt memory and potentially achieve code execution when combined with another vulnerability. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.
- Record
CVE-2026-85746- CVSS 3.1
- 9.9 Critical
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H - Weakness
- CWE-787
- Updated
- 2026-11-02
EUVDEUVD-2026-102940
MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, ST_AsText can write beyond an allocated output buffer when converting deeply nested GeometryCollections because recursive WKT serialization does not account for bytes consumed or reserve sufficient space. A low-privileged remote attacker can submit a specially crafted GIS object to corrupt memory and potentially achieve code execution when combined with another vulnerability. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.
- Record
EUVD-2026-102940- CVSS 3.1
- 9.9 Critical
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H - Updated
- 2026-11-02
NVD
MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, ST_AsText can write beyond an allocated output buffer when converting deeply nested GeometryCollections because recursive WKT serialization does not account for bytes consumed or reserve sufficient space. A low-privileged remote attacker can submit a specially crafted GIS object to corrupt memory and potentially achieve code execution when combined with another vulnerability. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.
- Record
CVE-2026-85746- CVSS 3.1
- 9.9 Critical
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H - Weakness
- CWE-787
- Updated
- 2026-11-02
OSVBELL-CVE-2026-85746
- Record
BELL-CVE-2026-85746- CVSS 3.1
- 9.9 Critical
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H - Updated
- 2026-11-04
OSV
MariaDB: Out-of-bound buffer write on in `ST_AsText` of nested GeometryCollections
MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, ST_AsText can write beyond an allocated output buffer when converting deeply nested GeometryCollections because recursive WKT serialization does not account for bytes consumed or reserve sufficient space. A low-privileged remote attacker can submit a specially crafted GIS object to corrupt memory and potentially achieve code execution when combined with another vulnerability. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.
- Record
CVE-2026-85746- CVSS 3.1
- 9.9 Critical
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H - Weakness
- CWE-787
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2026-85746
MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, ST_AsText can write beyond an allocated output buffer when converting deeply nested GeometryCollections because recursive WKT serialization does not account for bytes consumed or reserve sufficient space. A low-privileged remote attacker can submit a specially crafted GIS object to corrupt memory and potentially achieve code execution when combined with another vulnerability. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.
- Record
DEBIAN-CVE-2026-85746- CVSS 3.1
- 9.9 Critical
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H - Updated
- 2026-11-02
Show 8 moreShow less
OSVUBUNTU-CVE-2026-85746
MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, ST_AsText can write beyond an allocated output buffer when converting deeply nested GeometryCollections because recursive WKT serialization does not account for bytes consumed or reserve sufficient space. A low-privileged remote attacker can submit a specially crafted GIS object to corrupt memory and potentially achieve code execution when combined with another vulnerability. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.
- Record
UBUNTU-CVE-2026-85746- CVSS 3.1
- 9.9 Critical
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H - Updated
- 2026-11-02
OSVBIT-mariadb-2026-85746 No score
MariaDB: Out-of-bound buffer write on in `ST_AsText` of nested GeometryCollections
MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, ST_AsText can write beyond an allocated output buffer when converting deeply nested GeometryCollections because recursive WKT serialization does not account for bytes consumed or reserve sufficient space. A low-privileged remote attacker can submit a specially crafted GIS object to corrupt memory and potentially achieve code execution when combined with another vulnerability. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.
- Record
BIT-mariadb-2026-85746- Updated
- 2026-11-02
OSVBIT-mariadb-min-2026-85746 No score
MariaDB: Out-of-bound buffer write on in `ST_AsText` of nested GeometryCollections
MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, ST_AsText can write beyond an allocated output buffer when converting deeply nested GeometryCollections because recursive WKT serialization does not account for bytes consumed or reserve sufficient space. A low-privileged remote attacker can submit a specially crafted GIS object to corrupt memory and potentially achieve code execution when combined with another vulnerability. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.
- Record
BIT-mariadb-min-2026-85746- Updated
- 2026-11-02
OSVBIT-mysql-client-2026-85746 No score
MariaDB: Out-of-bound buffer write on in `ST_AsText` of nested GeometryCollections
MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, ST_AsText can write beyond an allocated output buffer when converting deeply nested GeometryCollections because recursive WKT serialization does not account for bytes consumed or reserve sufficient space. A low-privileged remote attacker can submit a specially crafted GIS object to corrupt memory and potentially achieve code execution when combined with another vulnerability. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.
- Record
BIT-mysql-client-2026-85746- Updated
- 2026-11-02
OSVCLSA-2026-1792636681 No score
mariadb: Fix of 6 CVEs
- CVE-2026-86047: quote identifiers and values in SHOW CREATE TABLE/USER, SHOW GRANTS, mariadb-dump, mariadb-show and mariadb-convert-table-format
- CVE-2026-92262: refuse #mysql50# names that mix up with table names in the table cache and on disk
- CVE-2026-85746: fix heap buffer overflow in ST_AsText() for nested geometry collections
- Record
CLSA-2026-1792636681- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:12245-1 No score
libmariadbd-devel-12.3.2-3.1 on GA media
These are all security issues fixed in the libmariadbd-devel-12.3.2-3.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:12245-1- Updated
- 2026-11-02
OSVROOT-OS-DEBIAN-12-CVE-2026-85746 No score
CVE-2026-85746 in mariadb - Patched by Root
Root has patched CVE-2026-85746 in the mariadb package for Root:Debian:12. Multiple fixed versions available.
- Record
ROOT-OS-DEBIAN-12-CVE-2026-85746- Updated
- 2026-11-02
OSVROOT-OS-DEBIAN-13-CVE-2026-85746 No score
CVE-2026-85746 in mariadb - Patched by Root
Root has patched CVE-2026-85746 in the mariadb package for Root:Debian:13. Multiple fixed versions available.
- Record
ROOT-OS-DEBIAN-13-CVE-2026-85746- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
mariadbAlpaquita:23 |
10.6.12-r0 up to 10.6.28-r0 | 10.6.28-r0 |
mariadbAlpaquita:25 |
11.4.5-r0 up to 11.4.13-r0 | 11.4.13-r0 |
mariadbAlpaquita:stream |
10.11.4-r0 up to 11.8.9-r0 | 11.8.9-r0 |
mariadbBitnami |
10.6.1 up to 10.6.28, 10.11.0 up to 10.11.19, 11.4.0 up to 11.4.13, 11.8.0 up to 11.8.9, 12.3.0 up to 12.3.3, 13.0.0 up to 13.0.2 | 10.6.2810.11.1911.4.1311.8.912.3.313.0.2 |
mariadb-minBitnami |
10.6.1 up to 10.6.28, 10.11.0 up to 10.11.19, 11.4.0 up to 11.4.13, 11.8.0 up to 11.8.9, 12.3.0 up to 12.3.3, 13.0.0 up to 13.0.2 | 10.6.2810.11.1911.4.1311.8.912.3.313.0.2 |
mysql-clientBitnami |
10.6.1 up to 10.6.28, 10.11.0 up to 10.11.19, 11.4.0 up to 11.4.13, 11.8.0 up to 11.8.9, 12.3.0 up to 12.3.3, 13.0.0 up to 13.0.2 | 10.6.2810.11.1911.4.1311.8.912.3.313.0.2 |
mariadbTuxCare:AlmaLinux:9.2 From an advisory covering 3 CVEs |
before 3:10.5.29-1.el9_2.alma.1.tuxcare.els6 | 3:10.5.29-1.el9_2.alma.1.tuxcare.els6 |
mariadb-backupTuxCare:AlmaLinux:9.2 From an advisory covering 3 CVEs |
before 3:10.5.29-1.el9_2.alma.1.tuxcare.els6 | 3:10.5.29-1.el9_2.alma.1.tuxcare.els6 |
mariadb-commonTuxCare:AlmaLinux:9.2 From an advisory covering 3 CVEs |
before 3:10.5.29-1.el9_2.alma.1.tuxcare.els6 | 3:10.5.29-1.el9_2.alma.1.tuxcare.els6 |
mariadb-develTuxCare:AlmaLinux:9.2 From an advisory covering 3 CVEs |
before 3:10.5.29-1.el9_2.alma.1.tuxcare.els6 | 3:10.5.29-1.el9_2.alma.1.tuxcare.els6 |
Show 25 moreShow less
| Package | Affected | Fixed |
|---|---|---|
mariadb-embeddedTuxCare:AlmaLinux:9.2 From an advisory covering 3 CVEs |
before 3:10.5.29-1.el9_2.alma.1.tuxcare.els6 | 3:10.5.29-1.el9_2.alma.1.tuxcare.els6 |
mariadb-embedded-develTuxCare:AlmaLinux:9.2 From an advisory covering 3 CVEs |
before 3:10.5.29-1.el9_2.alma.1.tuxcare.els6 | 3:10.5.29-1.el9_2.alma.1.tuxcare.els6 |
mariadb-errmsgTuxCare:AlmaLinux:9.2 From an advisory covering 3 CVEs |
before 3:10.5.29-1.el9_2.alma.1.tuxcare.els6 | 3:10.5.29-1.el9_2.alma.1.tuxcare.els6 |
mariadb-gssapi-serverTuxCare:AlmaLinux:9.2 From an advisory covering 3 CVEs |
before 3:10.5.29-1.el9_2.alma.1.tuxcare.els6 | 3:10.5.29-1.el9_2.alma.1.tuxcare.els6 |
mariadb-oqgraph-engineTuxCare:AlmaLinux:9.2 From an advisory covering 3 CVEs |
before 3:10.5.29-1.el9_2.alma.1.tuxcare.els6 | 3:10.5.29-1.el9_2.alma.1.tuxcare.els6 |
mariadb-pamTuxCare:AlmaLinux:9.2 From an advisory covering 3 CVEs |
before 3:10.5.29-1.el9_2.alma.1.tuxcare.els6 | 3:10.5.29-1.el9_2.alma.1.tuxcare.els6 |
mariadb-serverTuxCare:AlmaLinux:9.2 From an advisory covering 3 CVEs |
before 3:10.5.29-1.el9_2.alma.1.tuxcare.els6 | 3:10.5.29-1.el9_2.alma.1.tuxcare.els6 |
mariadb-server-galeraTuxCare:AlmaLinux:9.2 From an advisory covering 3 CVEs |
before 3:10.5.29-1.el9_2.alma.1.tuxcare.els6 | 3:10.5.29-1.el9_2.alma.1.tuxcare.els6 |
mariadb-server-utilsTuxCare:AlmaLinux:9.2 From an advisory covering 3 CVEs |
before 3:10.5.29-1.el9_2.alma.1.tuxcare.els6 | 3:10.5.29-1.el9_2.alma.1.tuxcare.els6 |
mariadb-testTuxCare:AlmaLinux:9.2 From an advisory covering 3 CVEs |
before 3:10.5.29-1.el9_2.alma.1.tuxcare.els6 | 3:10.5.29-1.el9_2.alma.1.tuxcare.els6 |
mariadbDebian:12 |
All versions, plus listed versions 1:10.11.11-0+deb12u11:10.11.13-0+deb12u11:10.11.14-0+deb12u11:10.11.14-0+deb12u21:10.11.18-0+deb12u1 Show 45 moreShow less1:10.11.19-0+deb12u11:10.11.3-11:10.11.3-2~exp11:10.11.4-11:10.11.4-1~deb12u11:10.11.5-11:10.11.5-21:10.11.5-31:10.11.6-0+deb12u11:10.11.6-11:10.11.6-21:10.11.6-2.1~exp11:10.11.7-11:10.11.7-21:10.11.7-31:10.11.7-41:10.11.8-11:10.11.9-0+deb12u11:11.4.2-11:11.4.2-21:11.4.2-31:11.4.2-41:11.4.3-11:11.4.4-11:11.4.4-21:11.4.4-31:11.4.5-11:11.4.5-2~exp11:11.8.1-11:11.8.1-21:11.8.1-31:11.8.1-41:11.8.1-51:11.8.2-11:11.8.3-11:11.8.5-11:11.8.5-21:11.8.5-31:11.8.5-3~exp11:11.8.5-3~exp21:11.8.5-3~exp31:11.8.5-41:11.8.6-11:11.8.6-21:11.8.6-3 |
None known |
mariadbDebian:13 |
All versions, plus listed versions 1:11.8.2-11:11.8.3-0+deb13u11:11.8.3-11:11.8.5-11:11.8.5-2 Show 18 moreShow less1:11.8.5-31:11.8.5-3~exp11:11.8.5-3~exp21:11.8.5-3~exp31:11.8.5-41:11.8.6-0+deb13u11:11.8.6-11:11.8.6-21:11.8.6-31:11.8.6-41:11.8.6-51:11.8.6-61:11.8.8-0+deb13u11:11.8.8-11:11.8.9+ds-11:11.8.9+ds-21:11.8.9+ds-31:11.8.9+ds-4 |
None known |
mariadbDebian:14 |
before 1:11.8.9+ds-1, plus listed versions 1:11.8.2-11:11.8.3-11:11.8.5-11:11.8.5-21:11.8.5-3 Show 11 moreShow less1:11.8.5-3~exp11:11.8.5-3~exp21:11.8.5-3~exp31:11.8.5-41:11.8.6-11:11.8.6-21:11.8.6-31:11.8.6-41:11.8.6-51:11.8.6-61:11.8.8-1 |
1:11.8.9+ds-1 |
mariadbRoot:Debian:12 |
before 1:10.11.19-0+deb12u1.aikido.13 | 1:10.11.19-0+deb12u1.aikido.13 |
rootio-mariadbRoot:Debian:12 |
before 1:10.11.19-0+deb12u1.aikido.13 | 1:10.11.19-0+deb12u1.aikido.13 |
mariadbRoot:Debian:13 |
before 1:11.8.6-0+deb13u1.aikido.11 | 1:11.8.6-0+deb13u1.aikido.111:11.8.6-0+deb13u1.aikido.12 |
rootio-mariadbRoot:Debian:13 |
before 1:11.8.6-0+deb13u1.aikido.11 | 1:11.8.6-0+deb13u1.aikido.111:11.8.6-0+deb13u1.aikido.12 |
mariadb-10.0Ubuntu:16.04:LTS |
All versions, plus listed versions 10.0.20-0ubuntu0.15.04.110.0.22-0ubuntu110.0.23-110.0.23-210.0.24-7 Show 9 moreShow less10.0.25-0ubuntu0.16.04.110.0.27-0ubuntu0.16.04.110.0.28-0ubuntu0.16.04.110.0.29-0ubuntu0.16.04.110.0.31-0ubuntu0.16.04.210.0.33-0ubuntu0.16.04.110.0.34-0ubuntu0.16.04.110.0.36-0ubuntu0.16.04.110.0.38-0ubuntu0.16.04.1 |
None known |
mariadb-10.1Ubuntu:18.04:LTS |
All versions, plus listed versions 10.1.25-11:10.1.29-61:10.1.34-0ubuntu0.18.04.11:10.1.38-0ubuntu0.18.04.11:10.1.38-0ubuntu0.18.04.2 Show 6 moreShow less1:10.1.40-0ubuntu0.18.04.11:10.1.41-0ubuntu0.18.04.11:10.1.43-0ubuntu0.18.04.11:10.1.44-0ubuntu0.18.04.11:10.1.47-0ubuntu0.18.04.11:10.1.48-0ubuntu0.18.04.1 |
None known |
mariadb-10.3Ubuntu:20.04:LTS |
All versions, plus listed versions 1:10.3.17-11:10.3.18-11:10.3.19-11:10.3.21-21:10.3.22-1 Show 10 moreShow less1:10.3.22-1ubuntu11:10.3.25-0ubuntu0.20.04.11:10.3.29-0ubuntu0.20.04.11:10.3.30-0ubuntu0.20.04.11:10.3.31-0ubuntu0.20.04.11:10.3.32-0ubuntu0.20.04.11:10.3.34-0ubuntu0.20.04.11:10.3.37-0ubuntu0.20.04.11:10.3.38-0ubuntu0.20.04.11:10.3.39-0ubuntu0.20.04.2 |
None known |
mariadb-10.6Ubuntu:22.04:LTS |
All versions, plus listed versions 1:10.6.7-2ubuntu11:10.6.7-2ubuntu1.11:10.6.11-0ubuntu0.22.04.11:10.6.12-0ubuntu0.22.04.11:10.6.16-0ubuntu0.22.04.1 Show 4 moreShow less1:10.6.18-0ubuntu0.22.04.11:10.6.21-0ubuntu0.22.04.21:10.6.22-0ubuntu0.22.04.11:10.6.23-0ubuntu0.22.04.1 |
None known |
mariadbUbuntu:24.04:LTS |
All versions, plus listed versions 1:10.11.4-11:10.11.5-31:10.11.6-11:10.11.6-21:10.11.7-2ubuntu1 Show 5 moreShow less1:10.11.7-2ubuntu21:10.11.8-0ubuntu0.24.04.11:10.11.11-0ubuntu0.24.04.21:10.11.13-0ubuntu0.24.04.11:10.11.14-0ubuntu0.24.04.1 |
None known |
mariadbUbuntu:26.10 |
All versions, plus listed versions 1:11.8.6-51:11.8.8-11:11.8.9+ds-4ubuntu2 |
None known |
mariadbUbuntu:26.04:LTS |
All versions, plus listed versions 1:11.8.3-1build11:11.8.5-11:11.8.5-21:11.8.5-31:11.8.5-4 Show 5 moreShow less1:11.8.6-11:11.8.6-31:11.8.6-41:11.8.6-51:11.8.6-5ubuntu0.1 |
None known |
mariadbopenSUSE:Tumbleweed From an advisory covering 22 CVEs |
before 12.3.2-3.1 | 12.3.2-3.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | ||
| affected, facts | OSV | |
| affected | OSV | |
| first indexed | CVE List, EUVD, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-85746 is a critical vulnerability (CVSS 9.9) in Devolutions Server, published October 16, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.97%, the 62nd percentile. Fixed in mariadb 10.6.28-r0.
References
github.com/MariaDB/server/security/advisories/GHSA-8fvj-c57c-pggx
Show 37 moreShow less
jira.mariadb.org/browse/MDEV-40329
docs.bell-sw.com/security/cves/CVE-2026-85746
nvd.nist.gov/vuln/detail/CVE-2026-85746
errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1792636681.html
security-tracker.debian.org/tracker/CVE-2026-85746
ubuntu.com/security/CVE-2026-85746
cve.org/CVERecord?id=CVE-2026-85746
suse.com/security/cve/CVE-2026-102523
Left out here: 8 versions. The JSON record has them.