MARIADB disclosed seven vulnerabilities on 16 October 2026: three rated critical with CVSS scores of 9.9, two high and two medium. The flaws affect versions 10.6, 10.11, 11.4, 11.8, 12.3 and 13.0 before the relevant fixes. A low-privileged database account may be enough to exploit some of them, putting servers used by web applications and hosting platforms at risk. No exploitation in the wild or public proof-of-concept has been confirmed.
The most serious issues include CVE-2026-92262, where a legacy “#mysql50#” table-name prefix bypasses normal filename encoding and can allow access to files, potentially leading to data corruption, data theft or remote code execution. CVE-2026-85746 is a memory-write overflow when ST_AsText processes deeply nested GIS objects; CVE-2026-85748 is a use-after-free in SYS_REFCURSOR handling, affecting only 12.3 and 13.0. MariaDB says code execution through the latter two flaws requires another bug. The roundup also describes a memory leak, CVE-2026-85745, that could help bypass ASLR in a multi-vulnerability attack.
MariaDB has issued fixes in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3 and 13.0.2. The report also recommends limiting database access for untrusted users and plugins, disabling the CONNECT engine if it is not needed, and checking database dumps before restoring them.