MariaDB CVE-2026-85745 requires build provenance checks

MariaDB disclosed CVE-2026-85745, an out-of-bounds read in ST_Area() when parsing an invalid WKB MultiPolygon. Six release lines from 10.6.1 to 13.0.1 are affected; fixes ship in 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3 and 13.0.2, with a base CVSS score of 4.3.

• Affected branches: 10.6, 10.11, 11.4, 11.8, 12.3 and 13.0
• Fixed releases: 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, 13.0.2
• Base CVSS 4.3; requires an authenticated SQL user session
• Rollbacks and stale container images can restore a vulnerable build