MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, ST_AsText can write beyond an allocated output buffer when converting deeply nested GeometryCollections because recursive WKT serialization does not account for bytes consumed or reserve sufficient space. A low-privileged remote attacker can submit a specially crafted GIS object to corrupt memory and potentially achieve code execution when combined with another vulnerability. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19,
    11.4.13, 11.8.9, 12.3.3, and 13.0.2, ST_AsText can write beyond an allocated output buffer when converting
    deeply nested GeometryCollections because recursive WKT serialization does not account for bytes consumed
    or reserve sufficient space. A low-privileged remote attacker can submit a specially crafted GIS object to
    corrupt memory and potentially achieve code execution when combined with another vulnerability. This issue
    is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2. (CVE-2026-85746)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19,     11.4.13, 11.8.9, 12.3.3, and 13.0.2, ST_AsText can write beyond an allocated output buffer when converting     deeply nested GeometryCollections because recursive WKT serialization does not account for bytes consumed     or reserve sufficient space. A low-privileged remote attacker can submit a specially crafted GIS object to     corrupt memory and potentially achieve code execution when combined with another vulnerability. This issue     is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2. (CVE-2026-85746)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
476122	Echo: mariadb: security update to 1:11.8.9+ds-2	Tenable Cloud Security	Echo Local Security Checks	Local	critical
476122	Echo: mariadb: security update to 1:11.8.9+ds-2	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	critical
366808	Linux Distros Unpatched Vulnerability : CVE-2026-85746	Nessus	Misc.	Local	critical

Detections

Analytics

CVE-2026-85746

critical

Tenable Plugins

critical

critical

critical