MariaDB Server Patched for Critical Buffer Overflow in GIS Geometry Conversion

MariaDB has released security updates to address a critical buffer overflow vulnerability in its server software. The flaw, identified as CVE-2026-85746, allows low-privileged remote attackers to potentially execute arbitrary code. According to the National Vulnerability Database, the issue stems from how the server handles Geographic Information System objects.

The vulnerability exists in the ST_AsText function, which converts geometry data into Well-Known Text format. When processing deeply nested GeometryCollections, the recursive serialization process fails to account for consumed bytes or reserve sufficient space. This oversight allows the function to write beyond the allocated output buffer, leading to memory corruption.

Technical Context and Impact

The National Vulnerability Database rates CVE-2026-85746 with a CVSS score of 9.9, classifying it as Critical. The weakness is categorized under CWE-787, which relates to out-of-bounds write errors. While the buffer overflow itself corrupts memory, achieving full code execution typically requires combining this flaw with another vulnerability.

Despite the need for a secondary exploit, the remote nature of the attack and the low privilege requirement make it a significant threat. Attackers can submit specially crafted GIS objects to trigger the overflow. This means that any service exposing MariaDB to untrusted input is at risk of exploitation.

Affected Versions and Fixes

MariaDB is a community-developed fork of the MySQL server. The vulnerability affects a wide range of versions across multiple release branches. Specifically, versions 10.6.1 through 10.6.27, 10.11.1 through 10.11.18, 11.4.1 through 11.4.12, 11.8.1 through 11.8.8, 12.3.1 through 12.3.2, and 13.0.1 are vulnerable.

Patches have been released for all affected branches. The fixes are included in MariaDB Server versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2. Administrators should verify their current version against this list to determine if an update is required.

What should you do?

Organizations running MariaDB should immediately check their server versions to see if they fall within the affected ranges. If an affected version is in use, apply the latest patch provided by the vendor. Additionally, review access controls to limit who can submit GIS data to the database.