---
id: CVE-2026-85746
title: >-
  mariadb: MariaDB: Out-of-bound buffer write on in `ST_AsText` of nested
  GeometryCollections (CVE-2026-85746)
summary: >-
  A flaw was found in MariaDB. An authenticated remote attacker with low
  privileges can cause memory corruption and potentially achieve arbitrary code
  execution by submitting specially crafted Geographic Information System (GIS)
  objects. Thi…
severity: high
cvss: 8.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cvssSource: vendor
cwe: CWE-787
vendor: Red Hat
product: Red Hat Hardened Images
affected:
  - enterprise_linux 10
  - enterprise_linux 7
  - enterprise_linux 8
  - enterprise_linux 9
  - openstack_platform_13_queens
  - hardened_images
patched:
  - hardened_images
published: '2026-10-16'
updated: '2026-10-26'
sourceUpdated: '2026-10-26T11:01:20+00:00'
source: CSAF
sourceUrl: 'https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-85746.json'
references:
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-85746.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-85746'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2554206'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-85746'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-85746'
  - url: >-
      https://github.com/MariaDB/server/commit/5c04ca5524385356ff7cf84974a7d491974c1f85
  - url: 'https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19'
  - url: 'https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28'
  - url: 'https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13'
  - url: 'https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9'
  - url: 'https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3'
  - url: 'https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2'
  - url: 'https://github.com/MariaDB/server/security/advisories/GHSA-8fvj-c57c-pggx'
  - url: 'https://jira.mariadb.org/browse/MDEV-40329'
  - url: 'https://access.redhat.com/errata/RHSA-2026:88864'
tags:
  - csaf
  - vex
  - red-hat
  - cve.org
epss: 0.0097
epssPercentile: 0.61718
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-16T16:49:55.618818Z'
scores:
  vendor: 8.8
  cna: 9.9
ingestedAt: '2026-10-16T17:24:46.963Z'
---

## Overview

A flaw was found in MariaDB. An authenticated remote attacker with low privileges can cause memory corruption and potentially achieve arbitrary code execution by submitting specially crafted Geographic Information System (GIS) objects. This issue is caused by an out-of-bounds write in the ST_AsText function, which fails to allocate sufficient buffer space during the conversion of deeply nested geometry collections.

## Vendor advisories

- **RHSA-2026:88864** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-10-23 · [advisory](https://access.redhat.com/errata/RHSA-2026:88864)
- **Red Hat VEX** · Important · affected: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat OpenStack Platform 13 (Queens) · no fix planned: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, … · updated 2026-10-26 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-85746.json)

**mariadb: MariaDB: Out-of-bound buffer write on in `ST_AsText` of nested GeometryCollections** — rated Important by Red Hat. Released 2026-10-16, updated 2026-10-26.

Affected:

- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 7
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9
- Red Hat OpenStack Platform 13 (Queens)

Fixed:

- Red Hat Hardened Images

No fix planned:

- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 7
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9
- Red Hat OpenStack Platform 13 (Queens)

Not affected:

- Red Hat Hardened Images

## Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to:
https://images.redhat.com/ https://access.redhat.com/errata/RHSA-2026:88864

Workarounds / mitigations:

- Upgrade to the fixed version of MariaDB Server