{"id":"CVE-2026-85746","title":"mariadb: MariaDB: Out-of-bound buffer write on in `ST_AsText` of nested GeometryCollections (CVE-2026-85746)","summary":"A flaw was found in MariaDB. An authenticated remote attacker with low privileges can cause memory corruption and potentially achieve arbitrary code execution by submitting specially crafted Geographic Information System (GIS) objects. Thi…","severity":"high","cvss":8.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvssSource":"vendor","cwe":"CWE-787","vendor":"Red Hat","product":"Red Hat Hardened Images","affected":["enterprise_linux 10","enterprise_linux 7","enterprise_linux 8","enterprise_linux 9","openstack_platform_13_queens","hardened_images"],"patched":["hardened_images"],"published":"2026-10-16","updated":"2026-10-26","sourceUpdated":"2026-10-26T11:01:20+00:00","source":"CSAF","sourceUrl":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-85746.json","references":[{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-85746.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-85746"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2554206"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-85746"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85746"},{"url":"https://github.com/MariaDB/server/commit/5c04ca5524385356ff7cf84974a7d491974c1f85"},{"url":"https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19"},{"url":"https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28"},{"url":"https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13"},{"url":"https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9"},{"url":"https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3"},{"url":"https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2"},{"url":"https://github.com/MariaDB/server/security/advisories/GHSA-8fvj-c57c-pggx"},{"url":"https://jira.mariadb.org/browse/MDEV-40329"},{"url":"https://access.redhat.com/errata/RHSA-2026:88864"}],"tags":["csaf","vex","red-hat","cve.org"],"epss":0.0097,"epssPercentile":0.61718,"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-10-16T16:49:55.618818Z"},"scores":{"vendor":8.8,"cna":9.9},"ingestedAt":"2026-10-16T17:24:46.963Z","slug":"CVE-2026-85746","body":"## Overview\n\nA flaw was found in MariaDB. An authenticated remote attacker with low privileges can cause memory corruption and potentially achieve arbitrary code execution by submitting specially crafted Geographic Information System (GIS) objects. This issue is caused by an out-of-bounds write in the ST_AsText function, which fails to allocate sufficient buffer space during the conversion of deeply nested geometry collections.\n\n## Vendor advisories\n\n- **RHSA-2026:88864** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-10-23 · [advisory](https://access.redhat.com/errata/RHSA-2026:88864)\n- **Red Hat VEX** · Important · affected: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat OpenStack Platform 13 (Queens) · no fix planned: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, … · updated 2026-10-26 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-85746.json)\n\n**mariadb: MariaDB: Out-of-bound buffer write on in `ST_AsText` of nested GeometryCollections** — rated Important by Red Hat. Released 2026-10-16, updated 2026-10-26.\n\nAffected:\n\n- Red Hat Enterprise Linux 10\n- Red Hat Enterprise Linux 7\n- Red Hat Enterprise Linux 8\n- Red Hat Enterprise Linux 9\n- Red Hat OpenStack Platform 13 (Queens)\n\nFixed:\n\n- Red Hat Hardened Images\n\nNo fix planned:\n\n- Red Hat Enterprise Linux 10\n- Red Hat Enterprise Linux 7\n- Red Hat Enterprise Linux 8\n- Red Hat Enterprise Linux 9\n- Red Hat OpenStack Platform 13 (Queens)\n\nNot affected:\n\n- Red Hat Hardened Images\n\n## Remediation\n\nFor details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/ https://access.redhat.com/errata/RHSA-2026:88864\n\nWorkarounds / mitigations:\n\n- Upgrade to the fixed version of MariaDB Server","depth":"twilight","depthScore":49,"depthScoreParts":{"impact":48.4,"likelihood":0.2,"exploitation":0,"ransomware":0},"changes":[{"seq":229323,"id":"CVE-2026-85746","ts":1793019686151,"field":"cvss","old":"9.9","new":"8.8"},{"seq":228565,"id":"CVE-2026-85746","ts":1792844793955,"field":"severity","old":"critical","new":"high"}]}