MariaDB Server CVE-2026-107816

Requires that the optional qc_info plugin be installed/loaded (it is NOT part of a default MariaDB installation) AND that the MariaDB query cache be enabled (query cache is deprecated and off by default in modern builds). The attacker must hold valid database credentials (PR:L) with privileges to execute queries and to read the information_schema.query_cache_info table. The trigger is specific: a query containing embedded null bytes must be cached, then the query_cache_info view read. Limiting factors: authentication is mandatory (no anonymous/unauthenticated path), the vulnerable code path only exists when the qc_info plugin is active, and impact is limited to partial memory disclosure or a server crash rather than code execution. Affected versions span 10.6.1 up to (but not including) the fixed 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.

This is a moderate-severity out-of-bounds read (CWE-125) with the vendor-supplied CVSS:3.1 vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:L (6.4, Medium). The signals are internally consistent and point to a real-but-bounded issue rather than a top-tier emergency: network reachable (AV:N) and low attack complexity (AC:L), but it requires an authenticated database session (PR:L) and yields only limited confidentiality impact (C:L, partial adjacent-memory disclosure) plus limited availability impact (A:L, server crash), with no integrity impact (I:N). The scope-changed flag (S:C) is defensible because the query cache is shared across sessions, so disclosed heap data could belong to other users/databases. Exploitation status: no public exploit identified at time of analysis - the only code reference is the upstream fix commit, not a weaponized POC. EPSS was NOT provided in the input, and the CVE is NOT on CISA KEV, so there is no evidence of active exploitation or high predicted exploitation probability. No SSVC decision data was supplied. The practical risk is further reduced by configuration prerequisites (see exploitation_conditions): the non-default qc_info plugin must be installed and the deprecated query cache must be enabled. Net: treat as a standard patch-cycle item for MariaDB deployments that actually load the qc_info plugin; de-prioritize where that plugin is absent.

An authenticated database user (even low-privileged) on a MariaDB server where the qc_info plugin is loaded and the query cache is enabled submits a query containing embedded null bytes, causing it to be cached with a miscomputed length. The attacker then selects from information_schema.query_cache_info, triggering an out-of-bounds read past a heap buffer that leaks adjacent process memory (potentially other sessions' data) or crashes the server (DoS). No public exploit code has been identified; network vector with low complexity makes exploitation straightforward once the plugin/query-cache preconditions are met.