MariaDB Server EUVD-2026-95923

Exploitation requires an authenticated database account holding BOTH the CREATE USER privilege and CREATE VIEW WITH GRANT OPTION; these are administrative-level grants, so this is an insider/privilege-boundary bypass rather than an anonymous attack. The concrete prerequisite is the ability to create a user whose username contains embedded newline (\n) characters encoding forged view FRM fields (e.g., definer_host=localhost, suid=1), then create a view so the FRM parser mis-parses the username as security metadata. Affected range is 10.6.1 up to (but not including) each fixed version; deployments already on 10.6.28/10.11.19/11.4.13/11.8.9/12.3.3/13.0.2 are not exploitable. Limiting factors: no remote unauthenticated path, high privilege requirement, and the attacker must control username creation - so environments that restrict CREATE USER/CREATE VIEW WITH GRANT OPTION to trusted administrators have substantially reduced real-world exposure.

This is a genuine but conditional privilege-escalation flaw whose real-world priority is moderate, not critical, despite the 7.2 (High) base score. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H is network-reachable and low-complexity, but the decisive limiter is PR:H: the attacker must already hold both CREATE USER and CREATE VIEW WITH GRANT OPTION privileges, which are administrative-grade grants rarely given to untrusted accounts. The flaw therefore functions as a privilege-boundary bypass for an already-privileged insider (or a compromised high-privilege account) rather than a path from zero access to compromise. No EPSS score was supplied, and the CVE is NOT in CISA KEV, so there is no evidence of active exploitation - exploitation status is 'no public exploit identified at time of analysis.' A fix commit with a regression test publicly demonstrates the exact technique (newline-laden username injecting view FRM security metadata), which lowers the bar for a skilled attacker to reproduce it, but that is distinct from a weaponized public exploit or in-the-wild use. Net: patch in normal cycles and prioritize where untrusted or semi-trusted users hold CREATE USER/CREATE VIEW WITH GRANT OPTION, but this is not a drop-everything internet-facing emergency. Missing signals to note explicitly: EPSS probability is absent and KEV status is negative, so no exploitation-likelihood telemetry is available to corroborate the severity.

A semi-trusted database user who has been granted CREATE USER and CREATE VIEW WITH GRANT OPTION creates an account whose username embeds newline characters followed by forged FRM fields such as 'definer_host=localhost' and 'suid=1'. When a view is created, the FRM parser misreads the injected portion of the username as legitimate security metadata, letting the attacker escalate their effective database privileges. No standalone public exploit is identified, but the vendor fix commit (MDEV-40484) ships a regression test that reproduces the injection step by step.