CVE-2026-85746 MySQL — Exploit & Vulnerability Details CRITICAL

Parameter	Value
CVSS	9.9 (CRITICAL)
Affected Versions	10.11.1 — 12.3.3
Fixed In	10.6.28
Type	CWE-787 (Out-of-bounds Write)
Vendor	MySQL
Public PoC	No

MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, ST_AsText can write beyond an allocated output buffer when converting deeply nested GeometryCollections because recursive WKT serialization does not account for bytes consumed or reserve sufficient space. A low-privileged remote attacker can submit a specially crafted GIS object to corrupt memory and potentially achieve code execution when combined with another vulnerability.

This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.

Attack Parameters

Attack Vector

Network

Can be exploited remotely

Attack Complexity

Low

Easy to exploit

Privileges Required

Low

Basic privileges needed

User Interaction

None

No user interaction needed

Impact Assessment

Confidentiality

High

Complete data leak

Integrity

High

Complete data modification

Availability

High

Complete denial of service

CVSS Vector v3.1

Weakness Type (CWE)

CWE-787 Out-of-bounds Write

Vulnerable Products 6

Configuration	From (including)	Up to (excluding)
Mariadb Mariadb cpe:2.3:a:mariadb:mariadb::::::::	`10.6.1`	`10.6.28`
Mariadb Mariadb cpe:2.3:a:mariadb:mariadb::::::::	`10.11.1`	`10.11.19`
Mariadb Mariadb cpe:2.3:a:mariadb:mariadb::::::::	`11.4.1`	`11.4.13`
Mariadb Mariadb cpe:2.3:a:mariadb:mariadb::::::::	`11.8.1`	`11.8.9`
Mariadb Mariadb cpe:2.3:a:mariadb:mariadb::::::::	`12.3.1`	`12.3.3`
Mariadb Mariadb cpe:2.3:a:mariadb:mariadb:13.0.1:::::::*	—	—