MariaDB server contains an out‑of‑bounds read in the ST_Area routine when handling malformed Well Known Binary data for a MultiPolygon. The function consumes more input than allocated, allowing a low‑privileged remote party to read memory located beyond the buffer. Leaked data can help bypass Address Space Layout Randomization as part of a larger exploitation chain, potentially leading to more severe attacks. The flaw does not directly grant code execution, but discloses useful memory contexts for subsequent attacks.

MariaDB server community editions are affected. Versions from 10.6.1 up to and including 10.6.28, 10.11.1‑10.11.19, 11.4.1‑11.4.13, 11.8.1‑11.8.9, 12.3.1‑12.3.3, and 13.0.1‑13.0.2 are vulnerable. All later releases contain the fix.

The CVSS score of 4.3 places the vulnerability in the lower "medium" range, suggesting limited direct impact. EPSS data is not available and the issue is not listed in CISA's KEV catalog, indicating no known active exploits. However, because a remote attacker can send crafted spatial data over the network, the risk remains for systems exposed to untrusted clients. Exploitation requires the ability to inject invalid WKB into the ST_Area function, so mitigation by network isolation and input validation is advisable.