MariaDB EUVD-2026-13764

Authenticated user with any database access required. Attacker must call JSON_SCHEMA_VALID() function with crafted input on MariaDB 11.4.0-11.4.9 or 11.8.0-11.8.5. RCE requires precise memory layout control, typically infeasible outside controlled lab environments.

The CVSS v3.1 score of 8.6 with vector AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H indicates a critical-severity vulnerability with network-based attack vector but high attack complexity. The PR:L requirement means an attacker needs valid database credentials, reducing the attack surface to authenticated users or scenarios where credentials are compromised. The AC:H (high complexity) and S:C (scope change) reflect that successful RCE requires precise control over memory layout, which the vendor explicitly notes is generally only achievable in laboratory conditions. The primary real-world risk is denial of service through server crashes, which is readily exploitable by any authenticated user. Without EPSS data or KEV listing, and given the high attack complexity for RCE, this should be prioritized for patching in environments with untrusted authenticated users, but the immediate risk is database availability rather than code execution. The technical impact is high for availability (immediate crash), but the RCE path requires specialized expertise and conditions.

An attacker who has obtained valid MariaDB database credentials (either through credential theft, insider access, or compromise of an application service account) connects to the database server and crafts a malicious query using the JSON_SCHEMA_VALID() function with specially crafted inputs that trigger the heap buffer overflow. The immediate result is a server crash causing denial of service for all database users. In a sophisticated attack scenario conducted in a controlled environment with precise knowledge of the server's memory layout and heap state, the attacker could theoretically leverage the buffer overflow to overwrite critical memory structures and achieve arbitrary code execution, potentially gaining control of the database server or the underlying operating system with the privileges of the MariaDB process.