Skip to main content

MariaDB EUVDEUVD-2026-13764

| CVE-2026-32710 HIGH
Heap-based Buffer Overflow (CWE-122)
2026-03-20 GitHub_M
RCE Buffer Overflow Heap Overflow MariaDB Red Hat Server Suse
8.5
CVSS 3.1 · GitHub Advisory
Share

Severity by source

GitHub Advisory PRIMARY
8.5 HIGH
AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
SUSE
HIGH
qualitative
Red Hat
7.5 MEDIUM
qualitative

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

Attack Vector
Network
Attack Complexity
High
Privileges Required
Low
User Interaction
None
Scope
Changed
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

6
Analysis Updated
Apr 16, 2026 - 06:19 EUVD-patch-fix
executive_summary
Re-analysis Queued
Apr 16, 2026 - 05:29 backfill_euvd_patch
patch_released
Patch available
Apr 16, 2026 - 05:29 EUVD
12.2.2,11.4.10,11.8.6
EUVD ID Assigned
Mar 20, 2026 - 18:46 euvd
EUVD-2026-13764
Analysis Generated
Mar 20, 2026 - 18:46 vuln.today
CVE Published
Mar 20, 2026 - 18:31 nvd
HIGH 8.5

DescriptionGitHub Advisory

MariaDB server is a community developed fork of MySQL server. An authenticated user can crash MariaDB versions 11.4 before 11.4.10 and 11.8 before 11.8.6 via a bug in JSON_SCHEMA_VALID() function. Under certain conditions it might be possible to turn the crash into a remote code execution. These conditions require tight control over memory layout which is generally only attainable in a lab environment. This issue is fixed in MariaDB 11.4.10, MariaDB 11.8.6, and MariaDB 12.2.2.

AnalysisAI

Authenticated users can trigger a heap overflow in MariaDB 11.4 (before 11.4.10) and 11.8 (before 11.8.6) through the JSON_SCHEMA_VALID() function, causing denial of service and potentially remote code execution under specific memory layout conditions. The vulnerability requires valid database credentials and affects server availability and integrity across scope boundaries. No patch is currently available for vulnerable versions.

Technical ContextAI

This vulnerability affects MariaDB Server (cpe:2.3:a:mariadb:server:*:*:*:*:*:*:*:*), a community-developed fork of MySQL that provides database management services. The issue is classified as CWE-122 (Heap-based Buffer Overflow) and manifests in the JSON_SCHEMA_VALID() function, which is used to validate JSON documents against JSON Schema definitions. Heap-based buffer overflows occur when a program writes data beyond the allocated heap memory boundaries, potentially corrupting adjacent memory structures. In this case, the buffer overflow during JSON schema validation operations can lead to memory corruption that crashes the server process and theoretically enables arbitrary code execution if an attacker can precisely manipulate heap layout.

RemediationAI

Upgrade MariaDB Server to version 11.4.10 or later for the 11.4 branch, version 11.8.6 or later for the 11.8 branch, or version 12.2.2 or later for the 12.x branch. Patches are available through the official MariaDB distribution channels, with full details in the GitHub Security Advisory at https://github.com/MariaDB/server/security/advisories/GHSA-4rj5-2227-9wgc and technical tracking information at https://jira.mariadb.org/browse/MDEV-38356. Until patching is complete, organizations can mitigate risk by restricting database access to only trusted authenticated users, implementing principle of least privilege for database accounts, monitoring for unexpected server crashes, and avoiding use of JSON_SCHEMA_VALID() function in production environments if feasible. Network-level controls such as database firewall rules and query filtering may provide defense-in-depth but will not prevent exploitation by legitimate authenticated users.

More in MariaDB

View all
CVE-2016-6662 CRITICAL POC
9.8 Sep 20

Oracle MySQL through 5.5.52, 5.6.x through 5.6.33, and 5.7.x through 5.7.15; MariaDB before 5.5.51, 10.0.x before 10.0.2
CVE-2012-5613 MEDIUM POC
6.0 Dec 03

MySQL 5.5.19 and possibly other versions, and MariaDB 5.5.28a and possibly other versions, when configured to assign the
CVE-2014-0195 MEDIUM POC
6.8 Jun 05

The dtls1_reassemble_fragment function in d1_both.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0
CVE-2014-0224 HIGH POC
7.4 Jun 05

OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
CVE-2012-2122 MEDIUM POC
5.1 Jun 26

sql/password.c in Oracle MySQL 5.1.x before 5.1.63, 5.5.x before 5.5.24, and 5.6.x before 5.6.6, and MariaDB 5.1.x befor
CVE-2012-5612 MEDIUM POC
6.5 Dec 03

Heap-based buffer overflow in Oracle MySQL 5.5.19 and other versions through 5.5.28, and MariaDB 5.5.28a and possibly ot
CVE-2012-5611 MEDIUM POC
6.5 Dec 03

Stack-based buffer overflow in the acl_get function in Oracle MySQL 5.5.19 and other versions through 5.5.28, and 5.1.53
CVE-2014-3470 MEDIUM
4.3 Jun 05

The ssl3_send_client_key_exchange function in s3_clnt.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before
CVE-2016-6664 HIGH POC
7.0 Dec 13

mysqld_safe in Oracle MySQL through 5.5.51, 5.6.x through 5.6.32, and 5.7.x through 5.7.14; MariaDB; Percona Server befo
CVE-2014-0221 MEDIUM
4.3 Jun 05

The dtls1_get_message_fragment function in d1_both.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.
CVE-2015-3152 MEDIUM POC
5.9 May 16

Oracle MySQL before 5.7.3, Oracle MySQL Connector/C (aka libmysqlclient) before 6.1.3, and MariaDB before 5.5.44 use the
CVE-2022-0778 HIGH POC
7.5 Mar 15

The BN_mod_sqrt() function, which computes a modular square root, contains a bug that can cause it to loop forever for n

Same weakness CWE-122 – Heap-based Buffer Overflow

View all
CVE-2023-4911 HIGH POC
7.8
CVE-2023-27997 CRITICAL
9.8
CVE-2025-25249 CRITICAL POC
9.8
CVE-2026-85880 HIGH POC
7.8
CVE-2025-24985 HIGH POC
7.8
CVE-2026-53362 HIGH POC
7.8
CVE-2025-21418 HIGH
7.8
CVE-2023-23376 HIGH
7.8

Same technique RCE

View all
CVE-2021-44228 CRITICAL POC
10.0
CVE-2017-7269 CRITICAL POC
9.8
CVE-2022-47966 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2023-3519 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2016-4117 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8

Vendor StatusVendor

SUSE

Severity: High
Product Status
SUSE Linux Enterprise High Performance Computing 15 SP7 SUSE Linux Enterprise Module for Server Applications 15 SP7 SUSE Linux Enterprise Server 15 SP7 SUSE Linux Enterprise Server for SAP Applications 15 SP7 Fixed
SUSE Linux Enterprise Module for Package Hub 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed
SUSE Linux Enterprise Module for Package Hub 15 SP7 Fixed
SUSE Linux Enterprise Module for Server Applications 15 SP7 Fixed

Share

EUVD-2026-13764 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy