CVE-2026-85746

Summary

A buffer overflow vulnerability in MariaDB's ST_AsText function allows attackers to write beyond allocated memory when processing deeply nested GeometryCollections, potentially leading to remote code execution when combined with other vulnerabilities.

Exploitability

Exploitation requires a low-privileged remote attacker who can submit crafted GIS objects; the attack is moderately difficult as it requires combining this vulnerability with another to achieve full RCE, but the primitive is well-suited for exploitation.

Blast radius

The vulnerability affects MariaDB installations across multiple major versions (10.6.x through 13.0.x) and could impact any application using GIS functions, particularly those handling spatial data from untrusted sources.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to MariaDB 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, or 13.0.2 immediately.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.