CVE-2026-85748

Name	CVE-2026-85748
Description	MariaDB server is a community developed fork of MySQL server. From 12.3.1 until 12.3.3 and 13.0.2, SYS_REFCURSOR handling is affected because cursor-array reallocation can leave stale references in routine contexts. A low-privileged attacker can open a large number of SYS_REFCURSORs and then fetch one to trigger a use-after-free that can enable remote code execution when combined with another vulnerability. This issue is fixed in versions 12.3.3 and 13.0.2.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
mariadb (PTS)	bookworm	1:10.11.18-0+deb12u1	fixed
	bookworm (security)	1:10.11.19-0+deb12u1	fixed
	trixie	1:11.8.6-0+deb13u1	fixed
	forky	1:11.8.9+ds-2	fixed
	sid	1:11.8.9+ds-4	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
mariadb	source	(unstable)	(not affected)

Notes

- mariadb <not-affected> (Vulnerable code not present)
https://github.com/MariaDB/server/security/advisories/GHSA-mv8g-9f7q-hprm
https://jira.mariadb.org/browse/MDEV-40396
https://jira.mariadb.org/browse/MDEV-40639