MariaDB Server EUVD-2026-95909

Requires the CONNECT storage engine to be installed and enabled, which is NOT part of a default MariaDB installation. The attacker must be an authenticated user holding privileges to create CONNECT tables using the DOS table_type, and must supply a crafted numeric column definition and value (the regression test uses double(255,30) with a large inserted value such as 1e50) that drives a one-byte null write past a stack buffer at an attacker-controlled offset. Limiting factors that reduce realistic risk: authentication is required (PR:L), the vulnerable engine is non-default, and high attack complexity (AC:H) means the practical outcome is a server crash while reliable remote code execution requires precise memory control; versions before the listed fixes (10.6.1 up to the fixed releases) are affected.

The vendor CVSS of 8.5 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) rates this high, but several signals temper the real-world urgency. Attack complexity is High (AC:H) and privileges are required (PR:L), meaning this is NOT an unauthenticated remote break - the attacker must already hold valid credentials with rights to create CONNECT-engine tables. No EPSS score was provided, there is no CISA KEV listing, and no public exploit was identified - only the upstream fix commit and a regression test (double(255,30) in a DOS table) are public, which demonstrate the crash but do not constitute weaponized exploit code. The description qualifies code execution as 'potentially,' and the primitive - a single null byte written past a stack buffer at an attacker-controlled offset - reliably yields a crash (DoS) but makes reliable RCE genuinely hard, consistent with AC:H. CONFLICT TO VERIFY: the vendor marks Scope Changed (S:C), which inflates the score; I assess Scope Unchanged because the corruption and any resulting code execution are contained within the mysqld process the authenticated attacker already interacts with - this disagreement alone accounts for much of the severity. Net: a real priority only where the non-default CONNECT storage engine is enabled and untrusted authenticated users can create tables; elsewhere it is a high-CVSS issue with limited practical exposure. Treat primarily as an authenticated DoS with a secondary, lower-probability RCE risk, and patch on the normal (not emergency) track unless CONNECT is exposed to low-trust tenants.

An authenticated MariaDB user with rights to create tables on a server where the CONNECT storage engine is enabled creates a DOS-type table containing a crafted numeric column (e.g., double(255,30)) and inserts an oversized value, triggering a one-byte null write past a stack buffer in value.cpp (SetValue_char). This crashes the server (denial of service) and could potentially be developed into remote code execution in the mysqld process. No public exploit exists; only the fix commit and its regression test are available.