Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain an out-of-bounds write vulnerability in certain… (CVE-2026-85969)

CVE-2026-85969 is an out-of-bounds write vulnerability affecting Progress MarkLogic Server 12.x releases prior to 12.1.0 and 11.x releases prior to 11.3.7. The vulnerability exists in specific language-processing functionality and can be exploited by a remote attacker with authentication privileges to cause server instability or limited modification of data. The CVSS v3.1 base score is 7.1, reflecting network attack vector, low attack complexity, required privileges, no user interaction, unchanged scope, no confidentiality impact, limited integrity impact, and high availability impact.

Exploitation of this vulnerability could lead to server instability, potentially causing denial of service conditions, and limited unauthorized modification of data. The attacker must be authenticated, which limits the attack surface. There is no indication of confidentiality loss. The impact is primarily on integrity and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor Progress's official channels for updates and apply any released patches for versions 12.1.0 or later and 11.3.7 or later once available.