Back Redpacketsecurity HackerOne Bug Bounty Disclosure: low-privilege-rce-in-mariadb-sys-refcursor-cursor-array-use-after-free-chained-with-an-st-area-heap-over-read-rick-de
Report title Low-privilege RCE in MariaDB: SYS_REFCURSOR cursor-array use-after-free chained with an ST_Area heap over-read
Report link
Date submitted 2026-10-07T19:47:06.419Z
The report’s title describes a potential remote code execution vulnerability in MariaDB. It says the issue may be reachable by a user with low-level database privileges and relies on chaining two memory-safety bugs: a use-after-free involving a SYS_REFCURSOR cursor array, and a heap over-read involving the ST_Area spatial function.
A use-after-free occurs when software continues using memory after it has been released. A heap over-read occurs when software reads beyond the intended bounds of a memory area. Either can cause instability or expose unintended data; combined, they may provide a way to influence how the database process behaves.
Why the combination matters
The report title suggests that the two flaws are chained: one may help create or control a useful memory condition, while the other contributes to the overall exploit. The claimed result is remote code execution, meaning an attacker could potentially make the database server run code. If confirmed, this could put the server and its data at serious risk.
The information provided here contains the report title and link, but not the report’s technical details, proof of concept, affected versions, or resolution. This summary therefore describes the claim in the title and does not independently verify its severity or exploitability.
A considerable amount of time and effort goes into maintaining this website, creating backend automation and creating new features and content for you to make actionable intelligence decisions. Everyone that supports the site helps enable new functionality.
If you like the site, please support us on Patreon or Buy Me A Coffee using the buttons below.
HackerOne report summary
Programme
Submitted by Rick de Jager
Profile
Report title Low-privilege RCE in MariaDB: SYS_REFCURSOR cursor-array use-after-free chained with an ST_Area heap over-read
Report link
Date submitted 2026-10-07T19:47:06.419Z
The report’s title describes a potential remote code execution vulnerability in MariaDB. It says the issue may be reachable by a user with low-level database privileges and relies on chaining two memory-safety bugs: a use-after-free involving a SYS_REFCURSOR cursor array, and a heap over-read involving the ST_Area spatial function.
A use-after-free occurs when software continues using memory after it has been released. A heap over-read occurs when software reads beyond the intended bounds of a memory area. Either can cause instability or expose unintended data; combined, they may provide a way to influence how the database process behaves.
Why the combination matters
The report title suggests that the two flaws are chained: one may help create or control a useful memory condition, while the other contributes to the overall exploit. The claimed result is remote code execution, meaning an attacker could potentially make the database server run code. If confirmed, this could put the server and its data at serious risk.
The information provided here contains the report title and link, but not the report’s technical details, proof of concept, affected versions, or resolution. This summary therefore describes the claim in the title and does not independently verify its severity or exploitability.
A considerable amount of time and effort goes into maintaining this website, creating backend automation and creating new features and content for you to make actionable intelligence decisions. Everyone that supports the site helps enable new functionality.
If you like the site, please support us on Patreon or Buy Me A Coffee using the buttons below.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
