CVE-2026-85748

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-85748", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-09-04T14:50:16.720Z", "datePublished": "2026-10-16T16:28:55.829Z", "dateUpdated": "2026-10-16T16:54:40.841Z"}, "containers": {"cna": {"title": "MariaDB: Use-after-free with a large number of SYS_REFCURSOR's", "problemTypes": [{"descriptions": [{"cweId": "CWE-416", "lang": "en", "description": "CWE-416: Use After Free", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.9, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/MariaDB/server/security/advisories/GHSA-mv8g-9f7q-hprm", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/MariaDB/server/security/advisories/GHSA-mv8g-9f7q-hprm"}, {"name": "https://github.com/MariaDB/server/commit/91156c3de58762196605150ab3f756fe952592d1", "tags": ["x_refsource_MISC"], "url": "https://github.com/MariaDB/server/commit/91156c3de58762196605150ab3f756fe952592d1"}, {"name": "https://github.com/MariaDB/server/commit/9b075b2cb53338f67e7230cc585e02d2d34514ed", "tags": ["x_refsource_MISC"], "url": "https://github.com/MariaDB/server/commit/9b075b2cb53338f67e7230cc585e02d2d34514ed"}, {"name": "https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3", "tags": ["x_refsource_MISC"], "url": "https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3"}, {"name": "https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2", "tags": ["x_refsource_MISC"], "url": "https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2"}, {"name": "https://jira.mariadb.org/browse/MDEV-40396", "tags": ["x_refsource_MISC"], "url": "https://jira.mariadb.org/browse/MDEV-40396"}, {"name": "https://jira.mariadb.org/browse/MDEV-40639", "tags": ["x_refsource_MISC"], "url": "https://jira.mariadb.org/browse/MDEV-40639"}], "affected": [{"vendor": "MariaDB", "product": "server", "versions": [{"version": ">= 12.3.1, < 12.3.3", "status": "affected"}, {"version": ">= 13.0.1, < 13.0.2", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-10-16T16:28:55.829Z"}, "descriptions": [{"lang": "en", "value": "MariaDB server is a community developed fork of MySQL server. From 12.3.1 until 12.3.3 and 13.0.2, SYS_REFCURSOR handling is affected because cursor-array reallocation can leave stale references in routine contexts. A low-privileged attacker can open a large number of SYS_REFCURSORs and then fetch one to trigger a use-after-free that can enable remote code execution when combined with another vulnerability. This issue is fixed in versions 12.3.3 and 13.0.2."}], "source": {"advisory": "GHSA-mv8g-9f7q-hprm", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-10-16T16:54:30.361781Z", "id": "CVE-2026-85748", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-16T16:54:40.841Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-85748", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-16T16:54:30.361781Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-16T16:54:35.522Z"}}], "cna": {"title": "MariaDB: Use-after-free with a large number of SYS_REFCURSOR's", "source": {"advisory": "GHSA-mv8g-9f7q-hprm", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.9, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "MariaDB", "product": "server", "versions": [{"status": "affected", "version": ">= 12.3.1, < 12.3.3"}, {"status": "affected", "version": ">= 13.0.1, < 13.0.2"}]}], "references": [{"url": "https://github.com/MariaDB/server/security/advisories/GHSA-mv8g-9f7q-hprm", "name": "https://github.com/MariaDB/server/security/advisories/GHSA-mv8g-9f7q-hprm", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/MariaDB/server/commit/91156c3de58762196605150ab3f756fe952592d1", "name": "https://github.com/MariaDB/server/commit/91156c3de58762196605150ab3f756fe952592d1", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/MariaDB/server/commit/9b075b2cb53338f67e7230cc585e02d2d34514ed", "name": "https://github.com/MariaDB/server/commit/9b075b2cb53338f67e7230cc585e02d2d34514ed", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3", "name": "https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2", "name": "https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2", "tags": ["x_refsource_MISC"]}, {"url": "https://jira.mariadb.org/browse/MDEV-40396", "name": "https://jira.mariadb.org/browse/MDEV-40396", "tags": ["x_refsource_MISC"]}, {"url": "https://jira.mariadb.org/browse/MDEV-40639", "name": "https://jira.mariadb.org/browse/MDEV-40639", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "MariaDB server is a community developed fork of MySQL server. From 12.3.1 until 12.3.3 and 13.0.2, SYS_REFCURSOR handling is affected because cursor-array reallocation can leave stale references in routine contexts. A low-privileged attacker can open a large number of SYS_REFCURSORs and then fetch one to trigger a use-after-free that can enable remote code execution when combined with another vulnerability. This issue is fixed in versions 12.3.3 and 13.0.2."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-416", "description": "CWE-416: Use After Free"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-10-16T16:28:55.829Z"}}}, "cveMetadata": {"cveId": "CVE-2026-85748", "state": "PUBLISHED", "dateUpdated": "2026-10-16T16:54:40.841Z", "dateReserved": "2026-09-04T14:50:16.720Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-10-16T16:28:55.829Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "server", "vendor": "MariaDB", "versions": [{"status": "affected", "version": ">= 12.3.1, < 12.3.3"}, {"status": "affected", "version": ">= 13.0.1, < 13.0.2"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*", "matchCriteriaId": "E6988F1C-2D11-431B-BBE4-3AA8483627C8", "versionEndExcluding": "12.3.3", "versionStartIncluding": "12.3.1", "vulnerable": true}, {"criteria": "cpe:2.3:a:mariadb:mariadb:13.0.1:*:*:*:*:*:*:*", "matchCriteriaId": "E46FBE57-06D5-489E-9ECE-333F5F9AFD06", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "MariaDB server is a community developed fork of MySQL server. From 12.3.1 until 12.3.3 and 13.0.2, SYS_REFCURSOR handling is affected because cursor-array reallocation can leave stale references in routine contexts. A low-privileged attacker can open a large number of SYS_REFCURSORs and then fetch one to trigger a use-after-free that can enable remote code execution when combined with another vulnerability. This issue is fixed in versions 12.3.3 and 13.0.2."}], "id": "CVE-2026-85748", "lastModified": "2026-10-20T15:32:54.420", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.9, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 6.0, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-85748", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-10-16T16:54:30.361781Z", "version": "2.0.3"}}]}, "published": "2026-10-16T17:17:51.303", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/MariaDB/server/commit/91156c3de58762196605150ab3f756fe952592d1"}, {"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/MariaDB/server/commit/9b075b2cb53338f67e7230cc585e02d2d34514ed"}, {"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3"}, {"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2"}, {"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/MariaDB/server/security/advisories/GHSA-mv8g-9f7q-hprm"}, {"source": "security-advisories@github.com", "tags": ["Issue Tracking"], "url": "https://jira.mariadb.org/browse/MDEV-40396"}, {"source": "security-advisories@github.com", "tags": ["Issue Tracking"], "url": "https://jira.mariadb.org/browse/MDEV-40639"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-416"}], "source": "security-advisories@github.com", "type": "Primary"}]}

{"bugzilla": {"description": "mariadb: mariadb: use-after-free in SYS_REFCURSOR during FETCH operations", "id": "2553279", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2553279"}, "csaw": false, "cvss3": {"cvss3_base_score": "8.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-416", "details": ["A flaw was found in MariaDB. An authenticated database user with low privileges can trigger a use-after-free memory corruption condition during cursor FETCH operations involving SYS_REFCURSOR. This flaw allows an attacker to corrupt memory and hijack program execution flow, potentially leading to privilege escalation and arbitrary code execution on the host system or causing a denial of service (DoS) by crashing the database server."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}, "name": "CVE-2026-85748", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "mariadb10.11", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "mariadb11.8", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "mariadb", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "mariadb:10.11/mariadb", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "mariadb:10.3/mariadb", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "mariadb", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "mariadb:10.11/mariadb", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "mariadb:11.8/mariadb", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Not affected", "package_name": "hi/mariadb", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Not affected", "package_name": "mariadb10.11", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Not affected", "package_name": "mariadb11.8", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:openstack:13", "fix_state": "Not affected", "package_name": "mariadb", "product_name": "Red Hat OpenStack Platform 13 (Queens)"}], "public_date": "2026-10-15T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-85748\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-85748\nhttps://hackerone.com/reports/3856148\nhttps://jira.mariadb.org/browse/MDEV-40639"], "statement": "A use-after-free vulnerability was found in MariaDB's SYS_REFCURSOR handling. When a large number of SYS_REFCURSOR cursors are opened, a Dynamic_array reallocation can leave dangling pointers that are later dereferenced during FETCH operations. An authenticated SQL user with low privileges can exploit this to gain control of the instruction pointer. SYS_REFCURSOR was introduced in MariaDB 12.0; no version of MariaDB shipped in Red Hat Enterprise Linux contains this feature. Fedora ships MariaDB 12.3, which is affected.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[12.3.1,12.3.3)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[13.0.1,13.0.2)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "server", "source": "cna", "vendor": "MariaDB"}, "product": "server", "vendor": "mariadb"}], "created": "2026-10-16T18:30:14.698780+00:00", "updated": "2026-10-23T10:45:16.901944+00:00", "vendors": ["mariadb", "mariadb$PRODUCT$server"]}