MariaDB Connector/Node.js EUVD-2026-95142

Exploitation requires the target application to serialize a GeoJSON Polygon or MultiPolygon value through the BINARY protocol via the connector's execute() or batch() APIs; the text-protocol query() path is explicitly NOT affected. The specific trigger is a malformed non-array 'ring' (e.g. an object exposing a numeric length, a string, or a number) whose length is used to size a Buffer.allocUnsafe() allocation before the type is validated, leaving reserved bytes unwritten. Limiting factors: the attacker must be able to influence the geometry value the application passes to the connector, the application must actually use binary-protocol prepared statements/batches with geometry (not plain query()), and the attacker must be able to read the persisted value back to recover the leaked heap bytes. Affected versions are those prior to 3.2.5, 3.3.4, 3.4.7, and 3.5.4.

The input CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, base 7.5) presents this as a network-reachable, unauthenticated, high-confidentiality issue, but that score overstates practical ease of exploitation. No EPSS score, no CISA KEV listing, and no public exploit were provided, so exploitation status is 'no public exploit identified at time of analysis' - the GitHub commit diffs in the input are the vendor FIX, not weaponized exploit code, and must not be conflated with a POC. No SSVC decision data was supplied. The real-world risk is conditional rather than broadly wormable: the defect is a CWE-200 uninitialized-memory disclosure in the GeoJSON Polygon/MultiPolygon BINARY encoders only (the text-protocol query() path is explicitly unaffected), so it triggers only when an application serializes attacker-influenceable geometry values through execute() or batch(). The PR:N in the vector reflects that the connector itself requires no DB authentication from the attacker's perspective, but the attacker does not call the connector directly - they must get malformed geometry (a non-array ring exposing a numeric length) into the application's query path AND be able to read the resulting stored value back, which raises real-world attack complexity above the AC:L in the input. Impact, however, is genuinely serious if triggered: leaked heap bytes may contain other users' data, session material, DB credentials, or TLS key material, and may propagate to backups and replicas. Net: a real patch-worthy issue for affected deployments, but closer to a targeted/conditional disclosure than a mass-exploitable network bug; the AC:L in the supplied vector should be treated with caution.

A Node.js application uses MariaDB Connector/Node.js and inserts user-supplied GeoJSON geometry into a spatial column via a prepared statement (execute()) or batch(). An attacker submits a Polygon/MultiPolygon whose ring is a non-array object carrying a large numeric length property; the encoder reserves that many uninitialized Buffer.allocUnsafe() bytes but the writing loop skips them, and the full buffer is sent to the database, persisting raw Node.js heap memory into the stored value, which the attacker then reads back. No public exploit code was identified at the time of analysis.