CVE-2026-85748: 
MariaDB Server vulnerability analysis and mitigation

CVE-2026-85748 is a use-after-free vulnerability in MariaDB Server's SYS_REFCURSOR handling that can enable remote code execution when chained with another vulnerability. It affects MariaDB Server versions 12.3.1 through 12.3.2 and 13.0.1. The vulnerability was published on October 15–16, 2026, and was reported by Rick de Jager from v12 security and Akhil Koul. It carries a CVSS v3.1 base score of 9.9 (Critical) (GitHub Advisory, Red Hat CVE).

The root cause is a use-after-free condition (CWE-416) in MariaDB's SYS_REFCURSOR implementation. When a routine opens a SYS_REFCURSOR and calls a function in its SELECT list that itself opens many SYS_REFCURSORs (exceeding the default 16-slot array capacity), the THD::m_statement_cursors dynamic array is reallocated, invalidating all previously stored sp_cursor_array_element pointers in the calling routine's context. A subsequent FETCH operation on the original cursor then accesses freed memory. The fix changed sp_cursor_array from storing elements by value (Dynamic_array<sp_cursor_array_element>) to storing heap-allocated pointers (Dynamic_array<sp_cursor_array_element*>), ensuring element addresses remain stable across reallocations (GitHub Commit MDEV-40639, GitHub Commit MDEV-40396). Exploitation requires only low privileges (a valid database account) and no user interaction, and is achievable over the network (GitHub Advisory).

Successful exploitation can result in full compromise of confidentiality, integrity, and availability of the affected MariaDB server. A low-privileged database user can trigger memory corruption that, when combined with a secondary vulnerability, enables remote code execution on the host system. The changed scope metric indicates that impact can extend beyond the database process itself, potentially allowing lateral movement to other systems or services accessible from the database host (GitHub Advisory, Red Hat CVE).

As of the time of publication, there is no public proof-of-concept exploit and no evidence of active in-the-wild exploitation (Red Hat CVE). The NVD SSVC assessment classifies exploitation as "none" and the attack as non-automatable, reflecting the requirement to chain this vulnerability with a second flaw for full RCE. The EPSS score is 0.0, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. No threat actor attribution has been reported.

1. Obtain low-privileged database access: Authenticate to a vulnerable MariaDB 12.3.1–12.3.2 or 13.0.1 instance with any valid database user account that has EXECUTE privileges on stored procedures/functions.
2. Create a cursor-reallocation trigger function: Define a stored function that declares and opens more than 16 SYS_REFCURSORs (the default array size), forcing a reallocation of THD::m_statement_cursors. For example, create trigger_realloc() that opens 17+ cursors and returns an integer.
3. Create an outer procedure that opens a SYS_REFCURSOR using the trigger function: Define a stored procedure that opens a SYS_REFCURSOR with OPEN c FOR SELECT trigger_realloc();, causing the inner function to execute and reallocate the cursor array while the outer cursor's pointer is live.
4. Call the outer procedure to trigger the use-after-free: Execute CALL trigger_uaf();. The reallocation during trigger_realloc() invalidates the outer cursor's sp_cursor_array_element pointer, leaving a stale reference.
5. Chain with a secondary vulnerability for RCE: Leverage the corrupted memory state in combination with another exploitable condition (e.g., a type confusion or memory disclosure bug) to achieve controlled code execution within the MariaDB server process (GitHub Advisory, GitHub Commit MDEV-40639).

• Database Logs: Repeated creation and execution of stored procedures/functions that open large numbers of SYS_REFCURSORs (17+) by a low-privileged user; unexpected MariaDB server crashes or core dumps in the MariaDB error log (/var/log/mysql/error.log or equivalent).
• Process: Unexpected child processes spawned by the mysqld process; abnormal memory usage or segmentation faults in the MariaDB server process.
• Network: Unusual outbound connections from the database server host to external IPs following stored procedure execution, which may indicate post-exploitation activity.
• File System: Unexpected new files or scripts in the MariaDB data directory or system directories; new cron jobs or scheduled tasks created under the database service account.

Upgrade MariaDB Server to version 12.3.3 (for the 12.3.x branch) or 13.0.2 (for the 13.x branch), which contain the fixes for both MDEV-40396 and MDEV-40639 (GitHub Release 12.3.3, GitHub Release 13.0.2). The official advisory states there is no workaround — users are advised to upgrade immediately (GitHub Advisory). As a defense-in-depth measure, restrict database access to trusted users and applications, and audit stored procedure execution privileges to limit exposure.

The vulnerability was reported by Rick de Jager from v12 security and Akhil Koul, and the advisory was published by the MariaDB security team on GitHub (GitHub Advisory). Red Hat has tracked the issue in their CVE database and linked it to a Bugzilla entry (Red Hat CVE). No significant broader community or social media discussion has been observed at this time.