tag
Cursor
MDEV-40328
binary
CRITICAL 8.8
MariaDB — Low-Privilege Remote Code Execution via ST_Area OOB Read + SYS_REFCURSOR Use-After-Free
This PoC chains two MariaDB memory-safety bugs to achieve remote code execution as the mariadbd process from a low-privilege database account — no special grants, no filesystem access, no administrative role:
Unpatched
2026-08-09