MariaDB Server CVE-2026-85748

Requires an authenticated, low-privileged MariaDB account (versions 12.3.1 through 12.3.2, i.e. before 12.3.3, and the 13.0.x branch before 13.0.2) with the ability to create and execute stored routines that use the SYS_REFCURSOR type - a feature only present in these recent 12.3+/13.0 branches. The attacker must declare and open more than the default 16 SYS_REFCURSORs inside a routine (the regression test uses 17 with max_open_cursors raised to 100) to force cursor-array reallocation, then fetch from a cursor to hit the use-after-free. Limiting factors: exploitation needs valid DB authentication (not unauthenticated), the SYS_REFCURSOR feature must be used, the deployment must run one of the narrow affected versions, and achieving remote code execution (rather than just a crash) requires chaining with a second, separate vulnerability.

The vendor CVSS of 9.9 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) reflects a network-reachable, low-complexity, low-privilege memory-corruption bug, which on its surface is a high priority. However, several signals temper this: no EPSS score was provided, the CVE is not in CISA KEV (so this is 'no public exploit identified at time of analysis'), and no SSVC decision framework data is supplied. Crucially, the description itself states RCE is only achievable 'when combined with another vulnerability' - so the confirmed standalone impact of this use-after-free is a server crash (availability loss), while the C:H/I:H/code-execution rating depends on chaining and heap control that are not demonstrated in the provided data. The only code evidence is the vendor's fix commit and a crash-reproducing regression test, not a weaponized exploit. Net: this is a genuine, patch-worthy memory-safety flaw that matters most for multi-tenant or internet-adjacent MariaDB instances where low-privileged SQL accounts are untrusted, but the real-world exploitation bar (authenticated access plus a second vulnerability for RCE) and the very narrow affected version window make it less of an immediate mass-exploitation threat than the 9.9 alone suggests.

A low-privileged but authenticated MariaDB user creates a stored function that declares and opens more than 16 SYS_REFCURSORs, forcing the cursor-array to reallocate and leaving stale references in the routine context; fetching from one of the cursors then triggers a use-after-free. On its own this reliably crashes the server (denial of service), and the vendor states it can enable remote code execution when chained with a second vulnerability. No public exploit exists - only the vendor's crash-reproducing regression test (MDEV-40639) is available.