{"id":"CVE-2026-85748","summary":"MariaDB: Use-after-free with a large number of SYS_REFCURSOR's","details":"MariaDB server is a community developed fork of MySQL server. From 12.3.1 until 12.3.3 and 13.0.2, SYS_REFCURSOR handling is affected because cursor-array reallocation can leave stale references in routine contexts. A low-privileged attacker can open a large number of SYS_REFCURSORs and then fetch one to trigger a use-after-free that can enable remote code execution when combined with another vulnerability. This issue is fixed in versions 12.3.3 and 13.0.2.","aliases":["GHSA-mv8g-9f7q-hprm"],"modified":"2026-10-17T07:06:54.676126676Z","published":"2026-10-16T16:28:55.829Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-416"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/85xxx/CVE-2026-85748.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/85xxx/CVE-2026-85748.json"},{"type":"FIX","url":"https://github.com/MariaDB/server/commit/91156c3de58762196605150ab3f756fe952592d1"},{"type":"FIX","url":"https://github.com/MariaDB/server/commit/9b075b2cb53338f67e7230cc585e02d2d34514ed"},{"type":"WEB","url":"https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3"},{"type":"WEB","url":"https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2"},{"type":"ADVISORY","url":"https://github.com/MariaDB/server/security/advisories/GHSA-mv8g-9f7q-hprm"},{"type":"WEB","url":"https://jira.mariadb.org/browse/MDEV-40396"},{"type":"WEB","url":"https://jira.mariadb.org/browse/MDEV-40639"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85748"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/mariadb/server","events":[{"introduced":"21a0714a118614982d20bfa504763d7247800091"},{"fixed":"83e909fc2a0dbc394b4b683fb3fa2d7dcf26cc5e"},{"introduced":"7f923870722c5d382e16d56af526d1ee4e03f987"},{"fixed":"620a4b5624222048fece7fe1789978ae0675cae2"}],"database_specific":{"source":"AFFECTED_FIELD","extracted_events":[{"introduced":"12.3.1"},{"fixed":"12.3.3"},{"introduced":"13.0.1"},{"fixed":"13.0.2"}]}}],"versions":["mariadb-13.0.1","mariadb-12.3.1"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-85748.json","vanir_signatures":[{"id":"CVE-2026-85748-1cd3e8db","signature_type":"Function","signature_version":"v1","source":"https://github.com/mariadb/server/commit/83e909fc2a0dbc394b4b683fb3fa2d7dcf26cc5e","target":{"file":"sql/log_event_server.cc","function":"Rows_log_event_fragmenter::fragment"},"deprecated":false,"digest":{"function_hash":"339712868486696881928202886484344029960","length":1715}},{"signature_version":"v1","source":"https://github.com/mariadb/server/commit/83e909fc2a0dbc394b4b683fb3fa2d7dcf26cc5e","target":{"file":"sql/log_event_server.cc"},"deprecated":false,"digest":{"line_hashes":["171922335289695664967320282302097012127","314879264303882873216162120692739820747","296657960952465744719770094395708912555","28908880241426286725700820784852115102"],"threshold":0.9},"id":"CVE-2026-85748-e432b228","signature_type":"Line"}],"vanir_signatures_modified":"2026-10-17T07:06:54Z"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"}]}