MariaDB Server: Out-of-bounds write in ST_AsText for nested GeometryCollections
Summary
MariaDB Server contains an out-of-bounds write in the GIS function ST_AsText when it converts deeply nested GeometryCollection objects to text (WKT). The recursive serialization does not account for bytes already written or reserve enough buffer space. An authenticated user with low privileges can submit a specially crafted GIS object over the network without user interaction. A bare overflow mainly causes a crash and data integrity problems; code execution is only realistic when combined with a second vulnerability.
Affected
- MariaDB Server 10.6.1 to 10.6.27
- MariaDB Server 10.11.1 to 10.11.18
- MariaDB Server 11.4.1 to 11.4.12
- MariaDB Server 11.8.1 to 11.8.8
- MariaDB Server 12.3.1 to 12.3.2
- MariaDB Server 13.0.1
Fixed in
- 10.6.28
- 10.11.19
- 11.4.13
- 11.8.9
- 12.3.3
- 13.0.2
- Distribution packages may lag behind; check your vendor's advisory.
Workaround
- No workaround is available according to the vendor. Upgrade to a fixed version.
- Until patching, restrict database access to trusted accounts and limit who can run spatial functions on untrusted input.
Exploitation
- No evidence of in-the-wild exploitation found; not listed in CISA KEV in our research.
- A third-party public proof-of-concept listing exists but could not be verified.
- CISA SSVC: exploitation none, automatable no, technical impact total.
Our recommendation
- Identify all MariaDB Server instances, including containers and packages from distributions, and check their versions.
- Upgrade to the fixed versions as a priority, especially where the database is reachable from user-facing applications or shared by several tenants.
- Until patched, limit database accounts and network access to the database port.
- Monitor database logs for crashes and unusual spatial function errors.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-8fvj-c57c-pggx github.com
- MariaDB bug tracker MDEV-40329 jira.mariadb.org
- Fix commit 5c04ca5 github.com
- MariaDB 10.11.19 release notes github.com
- MariaDB 10.6.28 release notes github.com
- MariaDB 11.4.13 release notes github.com
- MariaDB 11.8.9 release notes github.com
- Debian security tracker CVE-2026-85746 security-tracker.debian.org
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 15:16.
Original description (NVD)
MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, ST_AsText can write beyond an allocated output buffer when converting deeply nested GeometryCollections because recursive WKT serialization does not account for bytes consumed or reserve sufficient space. A low-privileged remote attacker can submit a specially crafted GIS object to corrupt memory and potentially achieve code execution when combined with another vulnerability. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.
NVD references (9)
- https://github.com/MariaDB/server/commit/5c04ca5524385356ff7cf84974a7d491974c1f85
- https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19
- https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28
- https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13
- https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9
- https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3
- https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2
- https://github.com/MariaDB/server/security/advisories/GHSA-8fvj-c57c-pggx
- https://jira.mariadb.org/browse/MDEV-40329
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.