MariaDB Server Patch Fixes Critical Use-After-Free Flaw in SYS_REFCURSOR Handling
A critical vulnerability in MariaDB Server allows remote code execution via cursor reallocation issues in specific versions.
Key points
- CVE-2026-85748 is rated Critical with a CVSS score of 9.9.
- The flaw affects MariaDB Server versions 12.3.1 through 12.3.3 and 13.0.1 through 13.0.2.
- Patches are available in versions 12.3.3 and 13.0.2.
MariaDB has released security updates to address a critical vulnerability in its server software that could allow remote code execution. The flaw, tracked as CVE-2026-85748, stems from improper handling of SYS_REFCURSOR objects during routine execution contexts.
At a glance
- CVE
- CVE-2026-85748
- Product
- MariaDB server
- CVSS
- 9.9 Critical
- Weakness
- use-after-free
- Exploited
- No known exploitation
The National Vulnerability Database rates this issue as Critical with a CVSS score of 9.9. According to the advisory, the weakness involves a use-after-free error triggered by cursor-array reallocation. This specific memory corruption issue falls under CWE-416, indicating that the software accesses memory after it has been freed.
Context and Background
MariaDB Server is a community-developed fork of the original MySQL server software. The vulnerability exists within the logic that manages SYS_REFCURSORs, which are used for passing result sets between stored procedures. The NVD record specifies that the problem arises because reallocation can leave stale references in routine contexts.
A low-privileged attacker can exploit this by opening a large number of SYS_REFCURSORs. The attacker then fetches one of these cursors to trigger the use-after-free condition. The source material notes that this specific flaw can enable remote code execution when combined with another vulnerability.
Who Is Affected
The vulnerability impacts specific ranges of MariaDB Server versions. Affected versions include those greater than or equal to 12.3.1 but less than 12.3.3. Additionally, versions greater than or equal to 13.0.1 but less than 13.0.2 are vulnerable. Organizations running these specific builds are at risk.
The issue is fixed in version 12.3.3 and version 13.0.2. Users currently running the affected versions should update to these patched releases to mitigate the risk. No other versions are listed as affected in the current advisory.
What should you do?
Administrators should immediately verify their current MariaDB Server version against the affected ranges. If running a vulnerable version, apply the latest update provided by the vendor. Monitor system logs for unusual cursor activity or memory errors that might indicate exploitation attempts.
What to do and how to stay safe: MariaDB
- Check current MariaDB Server version to see if it falls within the affected ranges.
- Apply the vendor-provided update to version 12.3.3 or 13.0.2 as soon as possible.
- Monitor database logs for abnormal SYS_REFCURSOR usage or memory access errors.
- Review access controls to limit low-privileged user capabilities where possible.
Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVSS score for CVE-2026-85748?
The National Vulnerability Database rates CVE-2026-85748 as Critical with a CVSS score of 9.9.
Which MariaDB Server versions are affected by this vulnerability?
Versions 12.3.1 through 12.3.3 and 13.0.1 through 13.0.2 are affected by this use-after-free flaw.
Is there a fix available for this vulnerability?
Yes, the issue is fixed in MariaDB Server versions 12.3.3 and 13.0.2.
