🎯 New Report #3915935: Heap Use-After-Free in Materialized cursor::open via SYS REFCURSOR Array Reallocation
🔺Severity: High
👽 Reporter: akkoul
⭐️ Reputation: 107
🛠 State: resolved
💼 Team: MariaDB
💵 Bounty: null
🕐 Submitted: 2026-08-04
⏰ Disclosed: 2026-10-07 19:46:11
📝 Summary: A heap-use-after-free vulnerability was identified in the cursor handling mechanism of the database server. The vulnerability existed in the cursor opening function where array reallocation during nested cursor operations caused dangling pointer references. When a cursor's SELECT statement invoked a function that opened additional cursors, the underlying memory buffer was reallocated, invalidating previously stored pointer addresses. These stale pointers were subsequently used for virtual method calls and memory writes, resulting in potential code execution and heap corruption. The issue affected authenticated users with function creation privileges and was distinct from a previously addressed related bug that had removed a stored member variable but had not corrected the parameter passing at the call site.
📂 Report JSON File: 3915935
@hackeronereports