{"id":"CVE-2026-85746","aliases":["BELL-CVE-2026-85746","BIT-mariadb-2026-85746","BIT-mariadb-min-2026-85746","BIT-mysql-client-2026-85746","CLSA-2026-1792636681","DEBIAN-CVE-2026-85746","EUVD-2026-102940","GHSA-8fvj-c57c-pggx","ROOT-OS-DEBIAN-12-CVE-2026-85746","ROOT-OS-DEBIAN-13-CVE-2026-85746","UBUNTU-CVE-2026-85746","openSUSE-SU-2026:12245-1"],"status":"published","title":"MariaDB: Out-of-bound buffer write on in `ST_AsText` of nested GeometryCollections","description":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, ST_AsText can write beyond an allocated output buffer when converting deeply nested GeometryCollections because recursive WKT serialization does not account for bytes consumed or reserve sufficient space. A low-privileged remote attacker can submit a specially crafted GIS object to corrupt memory and potentially achieve code execution when combined with another vulnerability. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.","severity":{"version":"3.1","score":9.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.0097,"percentile":0.62371,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-787"],"published":"2026-10-16T16:27:36Z","modified":"2026-11-04T07:15:51Z","fixes":[{"ecosystem":"Alpaquita:23","package":"mariadb","fixed_in":["10.6.28-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:25","package":"mariadb","fixed_in":["11.4.13-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"mariadb","fixed_in":["11.8.9-r0"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"mariadb","fixed_in":["10.6.28","10.11.19","11.4.13","11.8.9","12.3.3","13.0.2"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"mariadb-min","fixed_in":["10.6.28","10.11.19","11.4.13","11.8.9","12.3.3","13.0.2"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"mysql-client","fixed_in":["10.6.28","10.11.19","11.4.13","11.8.9","12.3.3","13.0.2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"mariadb","fixed_in":["1:11.8.9+ds-1"],"sources":["osv"]},{"ecosystem":"Root:Debian:12","package":"mariadb","fixed_in":["1:10.11.19-0+deb12u1.aikido.13"],"sources":["osv"]},{"ecosystem":"Root:Debian:12","package":"rootio-mariadb","fixed_in":["1:10.11.19-0+deb12u1.aikido.13"],"sources":["osv"]},{"ecosystem":"Root:Debian:13","package":"mariadb","fixed_in":["1:11.8.6-0+deb13u1.aikido.11","1:11.8.6-0+deb13u1.aikido.12"],"sources":["osv"]},{"ecosystem":"Root:Debian:13","package":"rootio-mariadb","fixed_in":["1:11.8.6-0+deb13u1.aikido.11","1:11.8.6-0+deb13u1.aikido.12"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpaquita:23","package":"mariadb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.6.12-r0"},{"fixed":"10.6.28-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:25","package":"mariadb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.4.5-r0"},{"fixed":"11.4.13-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"mariadb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.11.4-r0"},{"fixed":"11.8.9-r0"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"mariadb","ranges":[{"type":"SEMVER","events":[{"introduced":"10.6.1"},{"fixed":"10.6.28"},{"introduced":"10.11.0"},{"fixed":"10.11.19"},{"introduced":"11.4.0"},{"fixed":"11.4.13"},{"introduced":"11.8.0"},{"fixed":"11.8.9"},{"introduced":"12.3.0"},{"fixed":"12.3.3"},{"introduced":"13.0.0"},{"fixed":"13.0.2"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"mariadb-min","ranges":[{"type":"SEMVER","events":[{"introduced":"10.6.1"},{"fixed":"10.6.28"},{"introduced":"10.11.0"},{"fixed":"10.11.19"},{"introduced":"11.4.0"},{"fixed":"11.4.13"},{"introduced":"11.8.0"},{"fixed":"11.8.9"},{"introduced":"12.3.0"},{"fixed":"12.3.3"},{"introduced":"13.0.0"},{"fixed":"13.0.2"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"mysql-client","ranges":[{"type":"SEMVER","events":[{"introduced":"10.6.1"},{"fixed":"10.6.28"},{"introduced":"10.11.0"},{"fixed":"10.11.19"},{"introduced":"11.4.0"},{"fixed":"11.4.13"},{"introduced":"11.8.0"},{"fixed":"11.8.9"},{"introduced":"12.3.0"},{"fixed":"12.3.3"},{"introduced":"13.0.0"},{"fixed":"13.0.2"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"mariadb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:10.5.29-1.el9_2.alma.1.tuxcare.els6"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"mariadb-backup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:10.5.29-1.el9_2.alma.1.tuxcare.els6"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"mariadb-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:10.5.29-1.el9_2.alma.1.tuxcare.els6"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"mariadb-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:10.5.29-1.el9_2.alma.1.tuxcare.els6"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"mariadb-embedded","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:10.5.29-1.el9_2.alma.1.tuxcare.els6"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"mariadb-embedded-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:10.5.29-1.el9_2.alma.1.tuxcare.els6"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"mariadb-errmsg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:10.5.29-1.el9_2.alma.1.tuxcare.els6"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"mariadb-gssapi-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:10.5.29-1.el9_2.alma.1.tuxcare.els6"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"mariadb-oqgraph-engine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:10.5.29-1.el9_2.alma.1.tuxcare.els6"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"mariadb-pam","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:10.5.29-1.el9_2.alma.1.tuxcare.els6"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"mariadb-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:10.5.29-1.el9_2.alma.1.tuxcare.els6"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"mariadb-server-galera","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:10.5.29-1.el9_2.alma.1.tuxcare.els6"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"mariadb-server-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:10.5.29-1.el9_2.alma.1.tuxcare.els6"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"mariadb-test","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:10.5.29-1.el9_2.alma.1.tuxcare.els6"}]}],"bundled":3},{"source":"osv","ecosystem":"Debian:12","package":"mariadb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:10.11.11-0+deb12u1","1:10.11.13-0+deb12u1","1:10.11.14-0+deb12u1","1:10.11.14-0+deb12u2","1:10.11.18-0+deb12u1","1:10.11.19-0+deb12u1","1:10.11.3-1","1:10.11.3-2~exp1","1:10.11.4-1","1:10.11.4-1~deb12u1","1:10.11.5-1","1:10.11.5-2","1:10.11.5-3","1:10.11.6-0+deb12u1","1:10.11.6-1","1:10.11.6-2","1:10.11.6-2.1~exp1","1:10.11.7-1","1:10.11.7-2","1:10.11.7-3","1:10.11.7-4","1:10.11.8-1","1:10.11.9-0+deb12u1","1:11.4.2-1","1:11.4.2-2","1:11.4.2-3","1:11.4.2-4","1:11.4.3-1","1:11.4.4-1","1:11.4.4-2","1:11.4.4-3","1:11.4.5-1","1:11.4.5-2~exp1","1:11.8.1-1","1:11.8.1-2","1:11.8.1-3","1:11.8.1-4","1:11.8.1-5","1:11.8.2-1","1:11.8.3-1","1:11.8.5-1","1:11.8.5-2","1:11.8.5-3","1:11.8.5-3~exp1","1:11.8.5-3~exp2","1:11.8.5-3~exp3","1:11.8.5-4","1:11.8.6-1","1:11.8.6-2","1:11.8.6-3","1:11.8.6-4","1:11.8.6-5","1:11.8.6-6","1:11.8.8-1","1:11.8.9+ds-1","1:11.8.9+ds-2","1:11.8.9+ds-3","1:11.8.9+ds-4"]},{"source":"osv","ecosystem":"Debian:13","package":"mariadb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:11.8.2-1","1:11.8.3-0+deb13u1","1:11.8.3-1","1:11.8.5-1","1:11.8.5-2","1:11.8.5-3","1:11.8.5-3~exp1","1:11.8.5-3~exp2","1:11.8.5-3~exp3","1:11.8.5-4","1:11.8.6-0+deb13u1","1:11.8.6-1","1:11.8.6-2","1:11.8.6-3","1:11.8.6-4","1:11.8.6-5","1:11.8.6-6","1:11.8.8-0+deb13u1","1:11.8.8-1","1:11.8.9+ds-1","1:11.8.9+ds-2","1:11.8.9+ds-3","1:11.8.9+ds-4"]},{"source":"osv","ecosystem":"Debian:14","package":"mariadb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:11.8.9+ds-1"}]}],"versions":["1:11.8.2-1","1:11.8.3-1","1:11.8.5-1","1:11.8.5-2","1:11.8.5-3","1:11.8.5-3~exp1","1:11.8.5-3~exp2","1:11.8.5-3~exp3","1:11.8.5-4","1:11.8.6-1","1:11.8.6-2","1:11.8.6-3","1:11.8.6-4","1:11.8.6-5","1:11.8.6-6","1:11.8.8-1"]},{"source":"osv","ecosystem":"Root:Debian:12","package":"mariadb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.11.19-0+deb12u1.aikido.13"}]}]},{"source":"osv","ecosystem":"Root:Debian:12","package":"rootio-mariadb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.11.19-0+deb12u1.aikido.13"}]}]},{"source":"osv","ecosystem":"Root:Debian:13","package":"mariadb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:11.8.6-0+deb13u1.aikido.11"},{"fixed":"1:11.8.6-0+deb13u1.aikido.12"}]}]},{"source":"osv","ecosystem":"Root:Debian:13","package":"rootio-mariadb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:11.8.6-0+deb13u1.aikido.11"},{"fixed":"1:11.8.6-0+deb13u1.aikido.12"}]}]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"mariadb-10.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["10.0.20-0ubuntu0.15.04.1","10.0.22-0ubuntu1","10.0.23-1","10.0.23-2","10.0.24-7","10.0.25-0ubuntu0.16.04.1","10.0.27-0ubuntu0.16.04.1","10.0.28-0ubuntu0.16.04.1","10.0.29-0ubuntu0.16.04.1","10.0.31-0ubuntu0.16.04.2","10.0.33-0ubuntu0.16.04.1","10.0.34-0ubuntu0.16.04.1","10.0.36-0ubuntu0.16.04.1","10.0.38-0ubuntu0.16.04.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"mariadb-10.1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["10.1.25-1","1:10.1.29-6","1:10.1.34-0ubuntu0.18.04.1","1:10.1.38-0ubuntu0.18.04.1","1:10.1.38-0ubuntu0.18.04.2","1:10.1.40-0ubuntu0.18.04.1","1:10.1.41-0ubuntu0.18.04.1","1:10.1.43-0ubuntu0.18.04.1","1:10.1.44-0ubuntu0.18.04.1","1:10.1.47-0ubuntu0.18.04.1","1:10.1.48-0ubuntu0.18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"mariadb-10.3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:10.3.17-1","1:10.3.18-1","1:10.3.19-1","1:10.3.21-2","1:10.3.22-1","1:10.3.22-1ubuntu1","1:10.3.25-0ubuntu0.20.04.1","1:10.3.29-0ubuntu0.20.04.1","1:10.3.30-0ubuntu0.20.04.1","1:10.3.31-0ubuntu0.20.04.1","1:10.3.32-0ubuntu0.20.04.1","1:10.3.34-0ubuntu0.20.04.1","1:10.3.37-0ubuntu0.20.04.1","1:10.3.38-0ubuntu0.20.04.1","1:10.3.39-0ubuntu0.20.04.2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"mariadb-10.6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:10.6.7-2ubuntu1","1:10.6.7-2ubuntu1.1","1:10.6.11-0ubuntu0.22.04.1","1:10.6.12-0ubuntu0.22.04.1","1:10.6.16-0ubuntu0.22.04.1","1:10.6.18-0ubuntu0.22.04.1","1:10.6.21-0ubuntu0.22.04.2","1:10.6.22-0ubuntu0.22.04.1","1:10.6.23-0ubuntu0.22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"mariadb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:10.11.4-1","1:10.11.5-3","1:10.11.6-1","1:10.11.6-2","1:10.11.7-2ubuntu1","1:10.11.7-2ubuntu2","1:10.11.8-0ubuntu0.24.04.1","1:10.11.11-0ubuntu0.24.04.2","1:10.11.13-0ubuntu0.24.04.1","1:10.11.14-0ubuntu0.24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"mariadb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:11.8.6-5","1:11.8.8-1","1:11.8.9+ds-4ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"mariadb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:11.8.3-1build1","1:11.8.5-1","1:11.8.5-2","1:11.8.5-3","1:11.8.5-4","1:11.8.6-1","1:11.8.6-3","1:11.8.6-4","1:11.8.6-5","1:11.8.6-5ubuntu0.1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"mariadb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.3.2-3.1"}]}],"bundled":22}],"products":[{"vendor":"devolutions","product":"server"},{"vendor":"mariadb","product":"mariadb"},{"vendor":"mariadb","product":"server"}],"references":[{"url":"https://github.com/MariaDB/server/security/advisories/GHSA-8fvj-c57c-pggx","tags":["x_refsource_CONFIRM","Vendor Advisory","advisory","report"]},{"url":"https://github.com/MariaDB/server/commit/5c04ca5524385356ff7cf84974a7d491974c1f85","tags":["x_refsource_MISC","Patch","fix"]},{"url":"https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19","tags":["x_refsource_MISC","Release Notes","article","web"]},{"url":"https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28","tags":["x_refsource_MISC","Release Notes","article","web"]},{"url":"https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13","tags":["x_refsource_MISC","Release Notes","article","web"]},{"url":"https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9","tags":["x_refsource_MISC","Release Notes","article","web"]},{"url":"https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3","tags":["x_refsource_MISC","Release Notes","article","web"]},{"url":"https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2","tags":["x_refsource_MISC","Release Notes","article","web"]},{"url":"https://jira.mariadb.org/browse/MDEV-40329","tags":["x_refsource_MISC","Issue Tracking","report","web"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2026-85746","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85746","tags":["web","advisory"]},{"url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1792636681.html","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107814","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107821","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107823","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-86047","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-92262","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/85xxx/CVE-2026-85746.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-85746","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-85746","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-85746","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2026-102523","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-107814","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-107815","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-107816","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-107817","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-107818","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-107821","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-107822","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-107823","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-47023","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-60184","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-60331","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-60585","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-60747","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-61081","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-85745","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-85746","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-85748","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-85985","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-86047","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-92262","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-97380","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2026-85746","title":"MariaDB: Out-of-bound buffer write on in `ST_AsText` of nested GeometryCollections","description":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, ST_AsText can write beyond an allocated output buffer when converting deeply nested GeometryCollections because recursive WKT serialization does not account for bytes consumed or reserve sufficient space. A low-privileged remote attacker can submit a specially crafted GIS object to corrupt memory and potentially achieve code execution when combined with another vulnerability. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.","status":"published","published":"2026-10-16T16:27:36.763Z","modified":"2026-10-16T17:05:31.146Z","cvss":[{"version":"3.1","score":9.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"cna"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T14:19:52.410665Z"}],"euvd":[{"id":"EUVD-2026-102940","description":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, ST_AsText can write beyond an allocated output buffer when converting deeply nested GeometryCollections because recursive WKT serialization does not account for bytes consumed or reserve sufficient space. A low-privileged remote attacker can submit a specially crafted GIS object to corrupt memory and potentially achieve code execution when combined with another vulnerability. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.","status":"published","published":"2026-10-16T16:27:36Z","modified":"2026-10-16T17:05:31Z","cvss":[{"version":"3.1","score":9.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T17:00:04.71095Z"}],"nvd":[{"id":"CVE-2026-85746","description":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, ST_AsText can write beyond an allocated output buffer when converting deeply nested GeometryCollections because recursive WKT serialization does not account for bytes consumed or reserve sufficient space. A low-privileged remote attacker can submit a specially crafted GIS object to corrupt memory and potentially achieve code execution when combined with another vulnerability. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.","status":"published","published":"2026-10-16T17:17:51.167Z","modified":"2026-10-20T15:33:00.87Z","cvss":[{"version":"3.1","score":9.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T14:13:00.123071Z"}],"osv":[{"id":"BELL-CVE-2026-85746","status":"published","published":"2026-10-24T06:06:21.889602Z","modified":"2026-11-04T07:15:51.153842458Z","cvss":[{"version":"3.1","score":9.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-04T07:32:10.855619Z"},{"id":"CVE-2026-85746","title":"MariaDB: Out-of-bound buffer write on in `ST_AsText` of nested GeometryCollections","description":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, ST_AsText can write beyond an allocated output buffer when converting deeply nested GeometryCollections because recursive WKT serialization does not account for bytes consumed or reserve sufficient space. A low-privileged remote attacker can submit a specially crafted GIS object to corrupt memory and potentially achieve code execution when combined with another vulnerability. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.","status":"published","published":"2026-10-16T16:27:36.763Z","modified":"2026-10-28T11:18:59.817967369Z","cvss":[{"version":"3.1","score":9.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T15:45:18.825071Z"},{"id":"DEBIAN-CVE-2026-85746","description":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, ST_AsText can write beyond an allocated output buffer when converting deeply nested GeometryCollections because recursive WKT serialization does not account for bytes consumed or reserve sufficient space. A low-privileged remote attacker can submit a specially crafted GIS object to corrupt memory and potentially achieve code execution when combined with another vulnerability. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.","status":"published","published":"2026-10-16T17:17:51.167Z","modified":"2026-10-23T17:47:31.04211427Z","cvss":[{"version":"3.1","score":9.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:46:05.022702Z"},{"id":"UBUNTU-CVE-2026-85746","description":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, ST_AsText can write beyond an allocated output buffer when converting deeply nested GeometryCollections because recursive WKT serialization does not account for bytes consumed or reserve sufficient space. A low-privileged remote attacker can submit a specially crafted GIS object to corrupt memory and potentially achieve code execution when combined with another vulnerability. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.","status":"published","published":"2026-10-16T17:17:00Z","modified":"2026-10-28T20:17:24.482039636Z","cvss":[{"version":"3.1","score":9.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T16:57:24.828975Z"},{"id":"BIT-mariadb-2026-85746","title":"MariaDB: Out-of-bound buffer write on in `ST_AsText` of nested GeometryCollections","description":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, ST_AsText can write beyond an allocated output buffer when converting deeply nested GeometryCollections because recursive WKT serialization does not account for bytes consumed or reserve sufficient space. A low-privileged remote attacker can submit a specially crafted GIS object to corrupt memory and potentially achieve code execution when combined with another vulnerability. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.","status":"published","published":"2026-10-21T08:52:55.588Z","modified":"2026-10-22T09:00:02.442825194Z","updated_at":"2026-11-02T15:28:32.645004Z"},{"id":"BIT-mariadb-min-2026-85746","title":"MariaDB: Out-of-bound buffer write on in `ST_AsText` of nested GeometryCollections","description":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, ST_AsText can write beyond an allocated output buffer when converting deeply nested GeometryCollections because recursive WKT serialization does not account for bytes consumed or reserve sufficient space. A low-privileged remote attacker can submit a specially crafted GIS object to corrupt memory and potentially achieve code execution when combined with another vulnerability. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.","status":"published","published":"2026-10-21T08:53:10.328Z","modified":"2026-10-22T09:00:03.259729959Z","updated_at":"2026-11-02T15:28:32.645004Z"},{"id":"BIT-mysql-client-2026-85746","title":"MariaDB: Out-of-bound buffer write on in `ST_AsText` of nested GeometryCollections","description":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, ST_AsText can write beyond an allocated output buffer when converting deeply nested GeometryCollections because recursive WKT serialization does not account for bytes consumed or reserve sufficient space. A low-privileged remote attacker can submit a specially crafted GIS object to corrupt memory and potentially achieve code execution when combined with another vulnerability. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.","status":"published","published":"2026-10-21T08:56:36.086Z","modified":"2026-10-22T09:00:04.275112307Z","updated_at":"2026-11-02T15:28:33.469426Z"},{"id":"CLSA-2026-1792636681","title":"mariadb: Fix of 6 CVEs","description":"- CVE-2026-86047: quote identifiers and values in SHOW CREATE TABLE/USER, SHOW\n  GRANTS, mariadb-dump, mariadb-show and mariadb-convert-table-format\n- CVE-2026-92262: refuse #mysql50# names that mix up with table names in the\n  table cache and on disk\n- CVE-2026-85746: fix heap buffer overflow in ST_AsText() for nested geometry\n  collections","status":"published","published":"2026-10-22T11:18:34Z","modified":"2026-10-26T09:43:54.113188507Z","updated_at":"2026-11-02T15:43:54.672859Z"},{"id":"openSUSE-SU-2026:12245-1","title":"libmariadbd-devel-12.3.2-3.1 on GA media","description":"These are all security issues fixed in the libmariadbd-devel-12.3.2-3.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-10-23T00:00:00Z","modified":"2026-10-24T17:23:11.303910676Z","updated_at":"2026-11-02T16:58:40.245664Z"},{"id":"ROOT-OS-DEBIAN-12-CVE-2026-85746","title":"CVE-2026-85746 in mariadb - Patched by Root","description":"Root has patched CVE-2026-85746 in the mariadb package for Root:Debian:12. Multiple fixed versions available.","status":"published","published":"2026-10-22T10:39:02Z","modified":"2026-10-22T11:15:05.791138074Z","updated_at":"2026-11-02T15:53:32.570806Z"},{"id":"ROOT-OS-DEBIAN-13-CVE-2026-85746","title":"CVE-2026-85746 in mariadb - Patched by Root","description":"Root has patched CVE-2026-85746 in the mariadb package for Root:Debian:13. Multiple fixed versions available.","status":"published","published":"2026-10-22T12:36:03Z","modified":"2026-10-22T13:15:05.036369331Z","updated_at":"2026-11-02T15:53:33.681527Z"}]}}