MariaDB Server EUVD-2026-95918

Requires a specially prepared MySQL-origin table (.frm/.MYI/.MYD files) containing invalid MySQL binary JSON to be processed by MariaDB's legacy mysql_json compatibility plugin - the plugin that handles tables imported from MySQL. The attacker must get this hostile table into the server's data directory (implying local filesystem access) or trick an administrator into importing it, and the malformed table must then be parsed/accessed (e.g., via ALTER TABLE ... FORCE). Limiting factors that reduce real-world risk: the mysql_json import path must actually be exercised (environments that never import MySQL tables are unaffected), user interaction is required to trigger table access (UI:R), and the attack vector is local (AV:L) rather than network-reachable - it is not exploitable by an unauthenticated remote attacker against a default MariaDB deployment.

This is a genuinely low-to-moderate priority issue despite being tracked as a server vulnerability. The vendor CVSS of 4.4 (AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L) is consistent with the technical facts: a local attack vector requiring user interaction, yielding only partial confidentiality loss (OOB memory read) and partial availability loss (crash). No EPSS score, KEV listing, or SSVC decision data was provided in the input, so exploitation probability and automatability cannot be quantified from the signals given. There is no KEV entry and no POC flag set in the input - note, however, that the fix commit itself ships a reproducer test case (a crafted .MYD with byte-level corruption that triggers the error path), which demonstrates triggerability but is not a weaponized remote exploit. The PR:N in the CVSS vector is somewhat misleading given the description: real exploitation requires the attacker to get a crafted MySQL-origin table into the datadir and have it parsed by the legacy mysql_json compatibility plugin, which in practice implies either local filesystem access or social-engineering an administrator into importing a hostile table - verify this nuance against the vendor advisory GHSA-89ph-64cf-gqcc. Net: a real-but-narrow defect, not an urgent patch-tonight item unless the environment routinely imports untrusted MySQL tables.

An attacker crafts (or corrupts the binary JSON bytes within) a MySQL-origin table - the .frm/.MYI/.MYD files - containing invalid MySQL binary JSON, then gets it placed in the server's datadir or imported by an administrator. When the mysql_json plugin parses the table (for example during ALTER TABLE ... FORCE or normal access), it reads out of bounds, leaking adjacent memory contents or crashing the server (DoS). A reproducer exists in the fix commit, but no standalone public exploit was identified in the input.