MariaDB Connector/J CVE-2026-55858

Exploitation requires that character_set_client be changed to a non-UTF-8 value mid-session after the JDBC connection is fully initialized. Concrete triggers include: execution of SET NAMES with a non-UTF-8 charset (e.g., SET NAMES big5, SET NAMES gbk, SET NAMES latin1); invocation of a stored routine or trigger that internally alters character_set_client; server-level configuration changes propagated through OK-packet session-state tracking; or a hostile or compromised database server sending a forged OK-packet. The CVSS vector (AV:N/AC:H/PR:N) confirms network reachability but high complexity - the attacker must have a mechanism to influence the server-side charset. Connections that never experience a non-UTF-8 charset change are entirely unaffected. The attack is further limited by the requirement for a non-default multi-byte encoding on the database server, as most modern deployments default to utf8mb4.

The CVSS 3.1 score of 5.9 (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N) reflects the high attack complexity: exploitation requires the attacker to influence the server-side character_set_client mid-session, which is a specific and non-trivial precondition. EPSS data was not provided in the input, so exploitation probability cannot be quantified; the absence of a CISA KEV listing confirms no widely observed active exploitation at time of analysis. The real-world risk is strongly context-dependent: applications connecting to fully trusted, hardened database servers with no attacker-controlled database objects face minimal realistic risk, while applications connecting to multi-tenant databases, using third-party stored procedures, or exposed to hostile server scenarios face meaningful SQL injection risk. The CVSS integrity impact of High is appropriate given that successful charset-confusion can fully bypass parameterized-query-style escaping at the driver layer. No public exploit code has been identified, which further reduces near-term mass-exploitation probability; however, the vulnerability class is well understood and the exploit primitive is documented in prior research on GBK/BIG5 SQL injection.

An attacker who controls a database-side object (e.g., a stored procedure or trigger with sufficient privileges) or who can intercept an unencrypted database connection issues SET NAMES big5 or an equivalent non-UTF-8 charset command mid-session. The driver, now operating under an encoding mismatch, encodes a crafted string parameter containing a multi-byte sequence whose trailing byte is 0x27 (apostrophe) or 0x5C (backslash) in UTF-8 but is consumed as a continuation byte by the server's BIG5/GBK parser, escaping the quoting boundary and injecting arbitrary SQL. No public exploit code has been identified at time of analysis.