MariaDB Flaw Enables Remote Code Execution When Combined With Another Vulnerability

Security teams face a new remote code execution threat targeting MariaDB server instances. The vulnerability, tracked as CVE-2026-85748, carries a maximum CVSS score of 9.9. It enables an attacker with low-level privileges to gain control over the database server, but only when combined with another vulnerability. This exploit relies on manipulating how the server handles SYS_REFCURSOR objects. The National Vulnerability Database confirms the severity of this issue for administrators.

In plain English

The problem occurs when MariaDB manages memory for cursor arrays. During reallocation, the system can leave behind stale references in routine contexts. An attacker triggers this by opening many SYS_REFCURSORs and then fetching one. This action creates a use-after-free condition. By combining this flaw with another vulnerability, the attacker can enable remote code execution. The server essentially runs instructions it should not run.

The background

MariaDB is a community-developed fork of the MySQL server. The issue affects specific release windows in the software's history. Versions starting from 12.3.1 up to, but not including, 12.3.3 are affected. Additionally, version 13.0.1 is vulnerable, while 13.0.2 resolves the issue. The National Vulnerability Database lists these exact version ranges.

What changes now

The vendor has released fixes for the affected versions. Administrators should update their servers to version 12.3.3 or higher, or to version 13.0.2. These updates resolve the cursor-array reallocation issue. Until patches are applied, the risk of remote code execution remains high. Teams should prioritize updating these specific database instances immediately.

What made it possible

Memory management errors often arise when software reallocates buffers during runtime. In this class of incident, the system fails to clear old pointers after resizing an array. Attackers exploit this gap by triggering rapid reallocations, then dereferencing the stale pointers before the memory is overwritten. This technique typically serves as an initial foothold or privilege escalation step. Teams usually check for similar buffer handling patterns in their stack. Monitoring for unexpected memory access patterns can reveal such abuse early.

What to do and how to stay safe: MariaDB

• Audit your environment to identify all MariaDB server instances running versions 12.3.1, 12.3.2, or 13.0.1.
• Apply the vendor-provided updates to version 12.3.3 or 13.0.2 as soon as possible to close the vulnerability.
• Review database logs for unusual patterns of SYS_REFCURSOR creation and fetching, which may indicate exploitation attempts.
• Ensure that database accounts follow the principle of least privilege to limit the impact of any potential breach.

Step-by-step guide: Automatic Updates Mistakes That Leave Systems Exposed

General security guidance from the RedTeam Monitor newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which specific MariaDB versions are affected by CVE-2026-85748?

Versions 12.3.1 through 12.3.2 and version 13.0.1 are vulnerable. Versions 12.3.3 and 13.0.2 are fixed.

What is the CVSS score for this vulnerability?

The National Vulnerability Database rates CVE-2026-85748 as 9.9 Critical.

Can a low-privileged attacker exploit this flaw alone?

No, the attacker must combine this use-after-free flaw with another vulnerability to enable remote code execution.