CVE-2026-85748

A flaw was found in MariaDB. An authenticated database user with low privileges can trigger a use-after-free memory corruption condition during cursor FETCH operations involving SYS_REFCURSOR. This flaw allows an attacker to corrupt memory and hijack program execution flow, potentially leading to privilege escalation and arbitrary code execution on the host system or causing a denial of service (DoS) by crashing the database server.

A use-after-free vulnerability was found in MariaDB's SYS_REFCURSOR handling. When a large number of SYS_REFCURSOR cursors are opened, a Dynamic_array reallocation can leave dangling pointers that are later dereferenced during FETCH operations. An authenticated SQL user with low privileges can exploit this to gain control of the instruction pointer. SYS_REFCURSOR was introduced in MariaDB 12.0; no version of MariaDB shipped in Red Hat Enterprise Linux contains this feature. Fedora ships MariaDB 12.3, which is affected.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.