External risk intelligence

MariaDB ST_AsText Buffer Overflow Leading to Memory Corruption

CVE advisorySeverity: CRITICAL (CVSS 9.9)

CVE-2026-85746

MariaDB is a database server typically deployed in internal, backend network segments. While it is network-reachable within an environment, it is rarely exposed directly to the public internet by design. Access is usually mediated by application servers or restricted by internal firewalls, making direct internet-facing exposure uncommon in typical deployment patterns.

Out-of-bounds Write

Halo Surface Signal: 2 out of 5 — less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability exists in the MariaDB server that could allow a remote attacker to corrupt memory and potentially execute code. This occurs when processing specially crafted geographic data, due to an issue in how deeply nested data is serialized. The main concern is confirming relevance and exposure to this specific type of database and its processing of geographic information.

Database software has a memory corruption flaw.
Attackers could gain code execution.
Assess if geographic data is processed.

Attack Path

How an attacker could exploit the issue

An attacker with limited privileges could send a specially crafted geographic data object to a MariaDB server. The server's function for converting this data to text format can write beyond its allocated memory when handling complex, nested structures, potentially corrupting critical system data. This memory corruption, when combined with another security flaw, could allow the attacker to gain control of the server.

Low-privileged remote access required.
Specially crafted GIS object submission.
Memory corruption leading to code execution.

Live Threat

Current exploitation, exposure, and threat context

When supported by the advisory, a low-privileged attacker could exploit a vulnerability in the MariaDB server's handling of complex spatial data. This could lead to memory corruption, which, when combined with other issues, may result in code execution.

Risk to server memory and potential code execution.
Attacker submits crafted GIS data.
System compromise and data exposure.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in MariaDB server's GIS functionality requires action from teams managing database infrastructure and the applications that utilize spatial data. The first practical step is to inventory all MariaDB instances, determine which are running affected versions, and assess their exposure and criticality, particularly if they process GIS data. This will help identify the accountable database administrators or application owners to plan a coordinated remediation effort.

Database and application owners should act.
Verify GIS feature usage and exposure.
Plan updates during maintenance windows.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is MariaDB server and how is it used?

MariaDB is a popular open-source relational database management system that serves as a community-driven drop-in replacement for MySQL. It is widely used for storing and managing structured data in web applications, content management systems, and enterprise backends. Beyond standard data storage, MariaDB supports specialized features like GIS functions that allow users to store, query, and manipulate geographic or spatial data.

What is the memory corruption issue in CVE-2026-85746?

This vulnerability is classified as CWE-787, or Out-of-bounds Write. It occurs within the ST_AsText function, which translates geographic objects into human-readable text. When the server processes deeply nested geographic structures, the function fails to reserve enough memory for the output. This causes the software to write data beyond its intended buffer, potentially overwriting adjacent memory and enabling further unauthorized operations.

How does an attacker trigger this MariaDB vulnerability?

An attacker needs the ability to execute SQL commands on the server, even with low privileges. The trigger requires submitting a specially crafted, deeply nested geographic data object for processing by the ST_AsText function. Simply storing standard, non-nested spatial data or using basic database functions without these complex geometric triggers will not initiate the specific memory error described in this advisory.

Do I need to worry if my MariaDB instance is internal?

While Halo Surface Signal notes that MariaDB is rarely exposed directly to the public internet, internal exposure still matters. If an attacker gains initial access to your network, they could attempt to reach the database server. Because this vulnerability allows low-privileged accounts to influence system memory, it remains a concern for internal services where users or applications might submit untrusted geographic data.

How should I respond to this CVE-2026-85746 advisory?

Start by identifying all MariaDB instances in your environment and checking if their versions fall within the affected ranges. Prioritize instances that actively process geographic or spatial data, as these are the primary targets for this specific flaw. Coordinate with your database administrators to plan a maintenance window for applying the official security updates, as updating to the patched versions is the only way to resolve the buffer handling error.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.