Log in Start free

Vulnerability · Published Oct 16, 2026 · Assigned by GitHub_M

CVE-2026-85748MariaDB: Use-after-free with a large number of SYS_REFCURSOR's

Critical 9.9

In plain English

A critical-severity use-after-free in server from MariaDB. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.2% (higher than 68% of all known vulnerabilities).

Severity (CVSS 3.1)9.9Critical
Exploit odds (30 days)1.2%top 32.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

MariaDB server is a community developed fork of MySQL server. From 12.3.1 until 12.3.3 and 13.0.2, SYS_REFCURSOR handling is affected because cursor-array reallocation can leave stale references in routine contexts. A low-privileged attacker can open a large number of SYS_REFCURSORs and then fetch one to trigger a use-after-free that can enable remote code execution when combined with another vulnerability. This issue is fixed in versions 12.3.3 and 13.0.2.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Ubuntu:24.04:LTSmariadbno fix listedUBUNTU-CVE-2026-85748
Ubuntu:26.04:LTSmariadbno fix listedUBUNTU-CVE-2026-85748
Ubuntu:26.10mariadbno fix listedUBUNTU-CVE-2026-85748
Ubuntu:22.04:LTSmariadb-10.6no fix listedUBUNTU-CVE-2026-85748

Affected products (as reported)

VendorProductVersions
MariaDB server >= 12.3.1, < 12.3.3>= 13.0.1, < 13.0.2

Weakness: CWE-416 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

References