A use‑after‑free flaw in MariaDB’s SYS_REFCURSOR handling allows a low‑privileged attacker to open a large number of cursors and subsequently fetch one, leaking a stale reference that can be exploited to execute arbitrary code. The vulnerability is identified as CWE‑416 and can lead to remote code execution when combined with another defect. The official description limits the impact to environments running MariaDB server versions where the cursor reallocation logic has not been patched.

The flaw affects MariaDB Server versions 12.3.1 through 12.3.3 and the 13.0.2 release. Users running these builds are vulnerable; MariaDB releases 12.3.3 and 13.0.2 contain the fix and are not impacted.

With a CVSS score of 9.9, this vulnerability is classified as critical. The EPSS score is currently unavailable and the defect is not listed in CISA’s KEV catalog, suggesting a low public exploitation likelihood at present. However, the low‑privileged attack vector and potential for remote code execution mean that the risk is high for affected systems. A likely exploitation path involves an attacker with limited database access opening many SYS_REFCURSORs, then fetching a cursor to trigger the use‑after‑free and injecting malicious payloads if another vulnerability is present.