MariaDB Server CVE-2026-85746

Exploitation requires an authenticated database session (CVSS PR:L) with the ability to execute SQL that invokes the ST_AsText/AsText spatial function on attacker-controlled WKB geometry data forming a deeply nested GeometryCollection (the public PoC nests ~200 levels via repeat(x'010700000001000000', 200)). Affected builds are MariaDB 10.6.1 up to the listed fixed versions. Limiting factors: it is NOT remote-unauthenticated - the attacker needs valid low-privilege credentials or an application SQL-injection path into a spatial query; the input must reach the GIS WKT serialization code path; and full remote code execution is not standalone, explicitly requiring combination with another vulnerability, so the reliable standalone outcome is memory corruption / denial of service.

Signals are mixed and must be read carefully. The input CVSS of 9.9 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) is vendor/NVD-supplied and rates this at the top of the scale, driven largely by the Scope:Changed flag and assumed full C/I/A impact. However, the description itself qualifies the worst outcome: the bug is an out-of-bounds write (CWE-787) during recursive WKT serialization that corrupts memory, and code execution is only 'potentially' achievable 'when combined with another vulnerability.' Standalone, the reliably-demonstrated effect is memory corruption / server crash (denial of service), as shown by the public regression test that trips the Binary_string::qs_append assertion. PR:L is an important limiter: exploitation requires an authenticated, even if low-privileged, database session able to execute SQL invoking ST_AsText/AsText - this is not remote-unauthenticated. No EPSS score and no CISA KEV entry were provided, so there is no evidence of active or widespread exploitation; the exploitation signal here is a public proof-of-trigger embedded in the fix commit, not a weaponized RCE. I also dispute the Scope:Changed metric - the OOB write corrupts the mariadbd process's own memory within the same security authority, which argues for S:U and a lower real-world base score. Net: a genuinely serious memory-safety bug in a ubiquitous database worth prompt patching, but the headline 9.9 overstates standalone impact; realistic near-term risk is authenticated DoS, with RCE contingent on chaining. Verify the S:C choice and the RCE assumption against the MariaDB advisory.

A low-privileged but authenticated database user (or an attacker who has gained such credentials, or a web application with SQL-injection into a spatial query path) submits a crafted WKB blob representing a deeply nested GeometryCollection and calls ST_AsText/AsText on it, as demonstrated by the public reproducer select astext(concat(x'00000000', repeat(x'010700000001000000', 200), ...)). Because the recursive WKT serializer under-reserves buffer space, the server writes past the allocated output buffer, corrupting heap memory and crashing or destabilizing mariadbd. A public trigger exists in the fix commit's regression test; achieving code execution rather than a crash would require chaining with an additional primitive.