Key points
- CVE-2026-85748 affects MariaDB Server versions 12.3.1 through 12.3.2 and 13.0.1.
- The vulnerability is rated CVSS 9.9 Critical and involves a use-after-free error.
- Fixes are available in versions 12.3.3 and 13.0.2.
MariaDB Server versions 12.3.1 through 12.3.2 and version 13.0.1 contain a critical security flaw. The issue, tracked as CVE-2026-85748, has a CVSS score of 9.9. Patches are available in versions 12.3.3 and 13.0.2. Security teams should verify their current server versions immediately. Unpatched systems are vulnerable to remote code execution under specific conditions.
In plain English
The problem lies in how the database handles SYS_REFCURSOR objects. When the system reallocates memory for cursor arrays, it can leave behind stale references. An attacker with low privileges can exploit this by opening many cursors. Fetching one of these cursors triggers a use-after-free error. This memory corruption allows the attacker to run arbitrary code. The attack requires combining this flaw with another vulnerability.
The background
MariaDB Server is a community-developed fork of the MySQL server software. The NVD record identifies the weakness as CWE-416. The flaw exists in routine contexts where cursor-array reallocation occurs. It affects versions from 12.3.1 until 12.3.3 and version 13.0.2. The issue was resolved in the latest releases of those respective branches.
What changes now
Users running vulnerable versions must upgrade to 12.3.3 or 13.0.2. These updates fix the SYS_REFCURSOR handling logic. The patches eliminate the stale references that caused the use-after-free condition. Organizations should prioritize updating exposed database servers. Internal systems with strict access controls may have lower risk. However, the high severity score warrants immediate attention.
Who needs to act first
Teams usually prioritize systems facing the internet or untrusted networks. Check whether your database instances accept connections from external sources. Test the update in a non-production environment first. Back up your current configuration and data before applying changes. Verify that the patch resolves the issue without breaking applications. Monitor system logs for unusual activity during the rollout. Reduce exposure by restricting access to trusted IPs.
What to do and how to stay safe: MariaDB
- Identify all MariaDB Server instances running versions 12.3.1, 12.3.2, or 13.0.1.
- Apply the vendor-provided updates to versions 12.3.3 or 13.0.2 as soon as possible.
- Monitor network traffic for signs of exploitation attempts against unpatched systems.
- Review access controls to ensure only authorized users can connect to the database.
Step-by-step guide: 7 Configuration Errors That Expose Systems to Zero-Day Exploits
General security guidance from the Vuln Post newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which MariaDB Server versions are affected by CVE-2026-85748?
Versions 12.3.1 through 12.3.2 and version 13.0.1 are affected.
Is there a fix available for this vulnerability?
Yes, the issue is fixed in versions 12.3.3 and 13.0.2.
What is the severity rating of CVE-2026-85748?
The vulnerability has a CVSS score of 9.9, which is rated Critical.
