MariaDB UAF via SYS_REFCURSOR before 12.3.3 & 13.0.2
CVE-2026-85748 Published on October 16, 2026
MariaDB: Use-after-free with a large number of SYS_REFCURSOR's
MariaDB server is a community developed fork of MySQL server. From 12.3.1 until 12.3.3 and 13.0.2, SYS_REFCURSOR handling is affected because cursor-array reallocation can leave stale references in routine contexts. A low-privileged attacker can open a large number of SYS_REFCURSORs and then fetch one to trigger a use-after-free that can enable remote code execution when combined with another vulnerability. This issue is fixed in versions 12.3.3 and 13.0.2.
Vulnerability Analysis
CVE-2026-85748 is exploitable with network access, and requires small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to be critical as this vulnerability has a high impact to the confidentiality, integrity and availability of this component.
Weakness Type
What is a Dangling pointer Vulnerability?
Referencing memory after it has been freed can cause a program to crash, use unexpected values, or execute code.
CVE-2026-85748 has been classified to as a Dangling pointer vulnerability or weakness.
Affected Versions
MariaDB server:- Version >= 12.3.1, < 12.3.3 is affected.
- Version >= 13.0.1, < 13.0.2 is affected.