Is CVE-2026-85748 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-85748 being exploited in the wild.

How severe is CVE-2026-85748?

Critical severity, with a CVSS score of 9.9, published 16 October 2026.

Which products and versions are affected?

MariaDB Server 12.3.1 to 12.3.3, 13.0.2.

Is there a fix for CVE-2026-85748?

Yes: fixed in MariaDB Server 12.3.3, 13.0.2. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-85748 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-85748?

Check whether you run MariaDB Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-85748: MariaDB use-after-free in SYS_REFCURSOR cursor handling

CVE-2026-85748 · Severity: critical · CVSS 9.9 · Published 2026-10-16

MariaDB is a relational database server widely used in web applications and cloud services. A low-privileged database user can trigger a use-after-free vulnerability by opening many cursors and then fetching them, which could enable remote code execution when combined with another vulnerability. The flaw affects MariaDB 12.3.1–12.3.3 and 13.0.2 and has been patched in subsequent releases.

Technologies: MariaDB Server. Vendors: Mariadb.

Quick answers

Is CVE-2026-85748 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-85748 being exploited in the wild.
How severe is CVE-2026-85748?: Critical severity, with a CVSS score of 9.9, published 16 October 2026.
Which products and versions are affected?: MariaDB Server 12.3.1 to 12.3.3, 13.0.2.
Is there a fix for CVE-2026-85748?: Yes: fixed in MariaDB Server 12.3.3, 13.0.2. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-85748 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-85748?: Check whether you run MariaDB Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: MariaDB Server 12.3.3, 13.0.2

Technical details

A use-after-free in SYS_REFCURSOR cursor-array handling occurs when cursor array reallocation leaves stale pointers in routine contexts. When a routine opens many SYS_REFCURSORs and triggers cursor array resizing during fetch operations, previously cached cursor element pointers become invalid, allowing a low-privileged attacker to dereference freed memory. The vulnerability requires database connectivity and cursor creation privileges but no authentication bypass.

Affected products

MariaDB MariaDB Server 12.3.1 to 12.3.3, 13.0.2

Timeline

2026-10-16: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.