Back Redpacketsecurity HackerOne Bug Bounty Disclosure: heap-use-after-free-in-materialized-cursor-open-via-sys-refcursor-array-reallocation-akhil
Report title Heap Use-After-Free in Materialized_cursor::open via SYS_REFCURSOR Array Reallocation
Report link
Date submitted 2026-10-07T19:46:11.670Z
The report title describes a heap use-after-free vulnerability in the database component Materialized_cursor::open. It says the issue can occur when a SYS_REFCURSOR is handled in a way that causes an array to be reallocated.
A use-after-free happens when software continues to access memory after that memory has been released. If an array is reallocated, its old memory may no longer be valid. A cursor-opening routine that retains a reference to that old memory could therefore read or write invalid data, potentially causing a crash or other memory-safety problems.
Potential Impact and Limitations
The title identifies a specific code path involving SYS_REFCURSOR, but the report content provided here does not include reproduction steps, affected versions, demonstrated impact, or the vendor’s response. Those details are needed to determine how reliably the bug can be triggered and whether it could be used beyond causing instability.
A considerable amount of time and effort goes into maintaining this website, creating backend automation and creating new features and content for you to make actionable intelligence decisions. Everyone that supports the site helps enable new functionality.
If you like the site, please support us on Patreon or Buy Me A Coffee using the buttons below.
HackerOne report summary
Programme
Submitted by Akhil Koul
Profile
Report title Heap Use-After-Free in Materialized_cursor::open via SYS_REFCURSOR Array Reallocation
Report link
Date submitted 2026-10-07T19:46:11.670Z
The report title describes a heap use-after-free vulnerability in the database component Materialized_cursor::open. It says the issue can occur when a SYS_REFCURSOR is handled in a way that causes an array to be reallocated.
A use-after-free happens when software continues to access memory after that memory has been released. If an array is reallocated, its old memory may no longer be valid. A cursor-opening routine that retains a reference to that old memory could therefore read or write invalid data, potentially causing a crash or other memory-safety problems.
Potential Impact and Limitations
The title identifies a specific code path involving SYS_REFCURSOR, but the report content provided here does not include reproduction steps, affected versions, demonstrated impact, or the vendor’s response. Those details are needed to determine how reliably the bug can be triggered and whether it could be used beyond causing instability.
A considerable amount of time and effort goes into maintaining this website, creating backend automation and creating new features and content for you to make actionable intelligence decisions. Everyone that supports the site helps enable new functionality.
If you like the site, please support us on Patreon or Buy Me A Coffee using the buttons below.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
