Bug 2553280 (CVE-2026-85745)

Summary: CVE-2026-85745 mariadb: mariadb: out-of-bounds read in ST_Area with crafted MULTIPOLYGON
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: eglynn, jjoyce, jpretori, jschluet, lhh, mburns, mgarciac, rhel-process-autobot, watson-tool-maintainers
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in MariaDB. An authenticated database user can exploit an out-of-bounds read vulnerability by supplying a specially crafted spatial geometry to the ST_Area function. This issue allows reading beyond allocated memory buffers, leading to unauthorized information disclosure of internal process memory. An attacker could use this disclosed data to facilitate further attacks, such as bypassing security protections like Address Space Layout Randomization (ASLR).
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2554091, 2554093, 2554094    
Bug Blocks:    

Description OSIDB Bzimport 2026-10-15 10:21:58 UTC 
An out-of-bounds read vulnerability was found in MariaDB's ST_Area function. An authenticated, low-privileged SQL user can trigger the flaw by supplying a crafted MULTIPOLYGON geometry, which allows reading beyond allocated heap memory. This can reportedly disclose heap contents and executable base addresses, enabling ASLR bypass. When chained with a separate use-after-free vulnerability, this information disclosure can facilitate privilege escalation to operating-system command execution.

The researcher reports successful exploitation against MariaDB 13.0.1-rc with ASLR, PIE, and Full RELRO enabled.

Reference: https://hackerone.com/reports/3856148