🎯 New Report #3856148: Low-privilege RCE in MariaDB: SYS REFCURSOR cursor-array use-after-free chained with an ST Area heap over-read
🔺Severity: Critical
👽 Reporter: rdjgr
⭐️ Reputation: 107
🛠 State: resolved
💼 Team: MariaDB
💵 Bounty: null
🕐 Submitted: 2026-07-10
⏰ Disclosed: 2026-10-07 19:47:06
📝 Summary: A critical remote code execution vulnerability was discovered in MariaDB Server 13.0.2. The vulnerability chained two memory-safety bugs to allow an authenticated low-privilege user to execute arbitrary operating system commands as the database process user without requiring FILE, SUPER, or administrative privileges.

The first bug was a use-after-free condition in the system reference cursor array implementation. When the cursor array expanded, the backing buffer was reallocated, but open cursors retained raw pointers to the freed memory. Subsequent fetch operations dereferenced these dangling pointers, resulting in a virtual function call through an attacker-controlled vtable.

The second bug was an out-of-bounds heap read in the ST Area geospatial function. A missing bounds check in the multipolygon area calculation allowed reading past the geometry buffer when processing a crafted multipolygon with a declared polygon count exceeding the actual polygons present. This enabled an in-process memory disclosure oracle.

The exploit chain combined these bugs to leak heap and code addresses for defeating address space layout randomization and position-independent execution, then used the use-after-free to gain elevated database privileges and execute arbitrary commands. The complete end-to-end exploit was demonstrated against the released Docker image.
📂 Report JSON File: 3856148
@hackeronereports