External risk intelligence

MariaDB SYS_REFCURSOR Use-After-Free Enables Remote Code Execution.

CVE advisorySeverity: CRITICAL (CVSS 9.9)

CVE-2026-85748

MariaDB is a database server typically deployed in internal, protected network segments. While it supports network connectivity, it is rarely exposed directly to the public internet in standard deployments, as it usually sits behind application servers or internal firewalls that restrict direct access to the database port.

Use After Free

Halo Surface Signal: 2 out of 5 — less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability in the MariaDB server could allow a low-privileged attacker to execute remote code by exploiting a use-after-free flaw. This critical issue arises from how the server handles cursor references, potentially leading to significant compromise if combined with other vulnerabilities. The main concern is confirming relevance and exposure within our deployed environments.

Server flaw allows remote code execution.
Critical vulnerability demands attention.
Verify exposure and implement fixes.

Attack Path

How an attacker could exploit the issue

A low-privileged attacker could remotely connect to the MariaDB server, open a large number of database cursors, and then trigger a use-after-free vulnerability. This could lead to remote code execution if combined with another exploit.

Requires low-privileged access.
Triggered by fetching database cursors.
Risk of remote code execution.

Live Threat

Current exploitation, exposure, and threat context

A low-privileged attacker could achieve remote code execution on a MariaDB server when specific conditions are met, potentially impacting the integrity and availability of the database system. This could occur through a use-after-free vulnerability triggered by manipulating SYS_REFCURSORs.

Database server integrity and availability.
Triggered by a low-privileged attacker via cursor manipulation.
Remote code execution could lead to system compromise.

Operational Fix

Recommended remediation, mitigation, and detection steps

Real-world ownership of this vulnerability likely falls to the database administration (DBA) or infrastructure team responsible for managing MariaDB instances, with potential coordination needed from application owners if specific applications rely heavily on affected cursor functionality. The first practical step is to identify all MariaDB servers, confirm their exposure and business criticality, and then coordinate with the responsible teams to plan remediation during the next maintenance window.

Database administrators own the issue.
Verify vulnerable MariaDB instances.
Plan and execute upgrades during maintenance.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is MariaDB and what is it used for?

MariaDB is a widely used open-source relational database management system. It serves as a community-developed fork of MySQL and functions as the data storage engine for countless web applications, content management systems, and enterprise services, enabling them to store, retrieve, and manage structured information efficiently.

What does CWE-416 mean regarding CVE-2026-85748?

CWE-416 refers to a Use-After-Free vulnerability. In the context of this MariaDB flaw, the server mishandles memory when reallocating arrays for SYS_REFCURSORs. This leaves behind 'stale' references—pointers to memory that has already been freed—which can be manipulated to influence the program's execution flow.

How is this MariaDB vulnerability triggered?

An attacker with low-level database privileges must perform two main steps: first, open a large quantity of SYS_REFCURSORs to create specific memory conditions, and then fetch one of those cursors. Simply having a MariaDB server running is not enough; the attacker must be able to execute these specific database commands against an affected instance.

Is my MariaDB instance at risk?

Halo Surface Signal indicates that MariaDB is typically deployed in protected, internal network segments rather than exposed directly to the public internet. While the vulnerability is technically network-accessible, the risk is lower for instances shielded by firewalls or sitting behind application layers that restrict direct database connectivity.

What should I do to address this vulnerability?

The primary response is to identify all MariaDB instances in your environment and check their versions. If you are running an affected version, coordinate with your database administration team to schedule an upgrade to version 12.3.3 or 13.0.2 during your next maintenance window to apply the vendor-provided fix.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.