MariaDB Server EUVD-2026-102942

Requires an authenticated, low-privileged MariaDB account (PR:L) with the ability to execute SQL that passes attacker-controlled malformed WKB spatial data to the affected geometry functions - ST_Area, ST_Centroid (MultiPolygon), or GLength (MultiLineString). Affected builds are MariaDB server 10.6.1 up to (but not including) the fixed releases 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2; patched versions are not exploitable. Key limiting factors: valid database credentials are mandatory (no unauthenticated path), impact is confined to a bounded memory over-read with no write/corruption, and the leak is only operationally valuable when combined with a separate vulnerability in a chain - it does not by itself grant code execution or data modification.

This is a genuinely low-to-moderate priority issue despite being network-reachable. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, base 4.3 MEDIUM) is internally consistent with the description: a low-privileged remote attacker (PR:L) triggers an out-of-bounds read (CWE-126) that yields only limited confidentiality impact (C:L) and no integrity or availability impact. The description itself frames the flaw as a memory-disclosure primitive 'useful for bypassing ASLR as part of a multi-vulnerability chain' - i.e., not independently exploitable for code execution, which aligns with the low C impact and absence of I/A. No EPSS score, no CISA KEV listing, and no public exploit (POC) are present in the provided data, so there is no evidence of active or widespread exploitation. The source-code evidence (patch commit 2bf355e and test cases returning NULL / triggering ASAN) confirms the bug is real and fixed, but the test cases show the server returns NULL rather than crashing, reinforcing that this is an info-leak, not a DoS. Net: a legitimate defect worth patching on a normal cycle, but not an emergency - its value to an attacker depends on chaining it with other vulnerabilities. No key signals conflict; the main missing data are EPSS, KEV, and POC status (none supplied, meaning unknown rather than negative).

An attacker holding a low-privileged MariaDB account (PR:L) with the ability to run SQL submits a crafted, malformed WKB MultiPolygon value to a spatial function such as ST_Area(). The multi-polygon parser advances past a nested geometry header without verifying enough input remains, causing an out-of-bounds read that leaks adjacent heap memory. The leaked bytes can reveal pointers useful for defeating ASLR, which the attacker then combines with a separate memory-corruption bug to achieve code execution. No public exploit code is identified at time of analysis.