Do Son 
TL;DR
MariaDB disclosed seven more security flaws on October 16, 2026, including three rated CVSS 9.9. These MariaDB critical vulnerabilities let a low-privileged user corrupt memory or reach files, opening a path to remote code execution. Fixes are in 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3 and 13.0.2.
- Total: 7 CVEs
- Severity: 3 Critical · 2 High · 2 Medium
- Actively exploited: None confirmed
- Highest severity: 9.9 (Critical · CVSSv3) — CVE-2026-92262
- Action: Apply the latest security updates now
Notable CVEs
| CVE | CVSS (CVSSv3) | Type | Status |
|---|---|---|---|
| CVE-2026-92262 | 9.9 | CWE-706 | Not exploited |
| CVE-2026-85746 | 9.9 | CWE-787 | Not exploited |
| CVE-2026-85748 | 9.9 | CWE-416 | Not exploited |
| CVE-2026-97380 | 8.8 | CWE-620 | Not exploited |
| CVE-2026-86047 | 7.7 | CWE-89 | Not exploited |
| CVE-2026-85985 | 5.4 | CWE-862 | Not exploited |
| CVE-2026-85745 | 4.3 | CWE-126 | Not exploited |
Why It Matters
MariaDB powers countless web apps and hosting platforms. Many give database accounts to customers or plugins. In those setups, MariaDB critical vulnerabilities that only need a low-privileged login can still put the whole server at risk.
The same releases also fixed nine other MariaDB flaws we covered earlier this month.
How the Attacks Work
Critical flaws (CVSS 9.9)
- CVE-2026-92262: a legacy “#mysql50#” table-name prefix skips normal filename encoding. As a result, attackers can reach files directly and cause “data corruption, data exfiltration, or remote code execution.”
- CVE-2026-85746: a memory write overflow in ST_AsText when it converts deeply nested GIS objects.
- CVE-2026-85748: a use-after-free in SYS_REFCURSOR handling, found only in 12.3 and 13.0.
For the last two, MariaDB says code execution needs a second bug. Notably, CVE-2026-85745 fits that role. It leaks memory “useful for bypassing ASLR as part of a multi-vulnerability chain.”
Other flaws
- CVE-2026-97380 (8.8): a GRANT PROXY bug lets a low-privileged user set another account’s password.
- CVE-2026-86047 (7.7): poor quoting in SHOW CREATE output and mariadb-dump can plant SQL that runs when a dump is restored.
- CVE-2026-85985 (5.4): CONNECT engine file functions skip the FILE privilege check.
Exploitation status
No exploitation in the wild or public PoC has been confirmed. CISA lists exploitation as “none” for the three flaws it has assessed so far. None appear in its KEV catalog.
Affected Versions
The flaws affect MariaDB 10.6, 10.11, 11.4, 11.8, 12.3 and 13.0 before the fixed releases. CVE-2026-85748 affects only 12.3 and 13.0.
Patch and Mitigation Steps
- Upgrade to 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3 or 13.0.2.
- Limit database accounts for untrusted users and plugins.
- Disable the CONNECT engine if you do not use it.
- Review recent dumps before restoring them.
Full details sit in the MariaDB security advisories on GitHub. Given three 9.9 scores, admins should treat these MariaDB critical vulnerabilities as a priority.
Support Our Threat Intelligence
Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
