Progress MarkLogic Server 12.x releases before 12.1.0 contain an out-of-bounds read vulnerability in certain query-processing functionality. (CVE-2026-85968)

An out-of-bounds read vulnerability exists in certain query-processing functionality of Progress MarkLogic Server 12.x releases before 12.1.0. This vulnerability can be exploited remotely by an authenticated attacker to cause server instability or to disclose limited information from the server's process memory. The CVSS 3.1 base score is 7.1, reflecting network attack vector, low attack complexity, required privileges, no user interaction, unchanged scope, limited confidentiality impact, no integrity impact, and high availability impact.

Exploitation of this vulnerability could lead to server instability, potentially causing denial of service conditions. Additionally, limited information disclosure from process memory could occur, which may aid an attacker in further attacks or reconnaissance. The impact is limited to confidentiality and availability, with no integrity impact reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor vendor communications for updates. Until a fix is available, restrict access to authenticated users and limit privileges to reduce exploitation risk.