MariaDB
Monthly
An authorization bypass in MariaDB Server lets an authenticated database user who can run ALTER TABLE against a partitioned table make ALTER TABLE ... CONVERT ... PARTITION operate on table files belonging to other tables, because the user-supplied partition name is inserted into the on-disk file path without filename encoding. Successful abuse yields unauthorized reads and modifications of other tables' data, and the effect is confined to servers running affected releases (10.11.1 through 10.11.18, 11.4.1 through 11.4.12, 11.8.1 through 11.8.8, 12.3.1 through 12.3.2, and 13.0.1) with the partition plugin active, which is the default. No public exploit code was identified at time of analysis and the issue is not in CISA KEV; the vendor fix is contained in 10.11.19, 11.4.13, 11.8.9, 12.3.3 and 13.0.2, and the practical barrier is that the attacker already needs a database foothold with ALTER rights on the target table.
Unauthenticated SQL injection in Apache OFBiz 24.09 (before 24.09.08) allows a remote attacker to disclose arbitrary rows from the queried entity when the deployment is backed by MySQL or MariaDB. The flaw lives in the entity engine's generic performFind service: an ignore-case find request (_ic=Y) with a crafted value causes SqlJdbcUtil.addValueSingle to inline the EntityFunction-wrapped value into the SQL text using ANSI-only single-quote doubling, which backslash-terminated payloads defeat on MySQL/MariaDB because those dialects also honor backslash escapes, turning the WHERE clause into a tautology. Only confidentiality is impacted per the assessed vector; the default Derby datasource and PostgreSQL are explicitly not affected, EPSS is low at 0.28% (20th percentile), and no public exploit has been identified at time of analysis, although the vendor has released 24.09.08 and the issue carries an act_now priority decision.
Improper quoting during SQL serialization in MariaDB Server 10.6.1 through 10.6.27, 10.11.18, 11.4.12, 11.8.8, 12.3.2 and 13.0.1 and earlier allows a low-privileged authenticated attacker who can create a foreign-data-wrapper SERVER, USER, UDF, plugin, or trigger with crafted identifiers or option values to inject arbitrary SQL into the output of SHOW CREATE SERVER, SHOW CREATE USER, or mariadb-dump; the injected statements execute only when a privileged operator later replays that generated SQL, such as during a dump restore. Exploitation requires both a pre-existing low-privileged account (CVSS PR:L) and a victim-initiated action (UI:R), so this is a conditional, stored-injection-style threat rather than an unauthenticated remote compromise. No public exploit code has been identified at time of analysis, and the issue is fixed in MariaDB 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3 and 13.0.2.
Use-after-free in MariaDB Server's SYS_REFCURSOR handling (12.3.1 through 12.3.2, and the 13.0.x branch before 13.0.2) lets an authenticated, low-privileged database user crash the server and corrupt server memory by declaring and opening more than the default 16 SYS_REFCURSORs inside a stored routine and then fetching from one of them. The flaw is a stale-reference bug in the cursor array: when the array is reallocated to grow beyond its initial 16 slots, routine-context references still point at the freed element, and the resulting use-after-free can be leveraged for remote code execution only when chained with a second, separate vulnerability. Authentication is required (CVSS PR:L, AV:N), and no public exploit code or confirmed active exploitation has been identified at the time of analysis; the vendor CVSS of 9.9 is high, but practical impact is bounded by the narrow affected version range and the need for CREATE ROUTINE/EXECUTE privileges plus a second bug to convert memory corruption into code execution.
An out-of-bounds write in MariaDB Server's spatial WKT serialization allows an authenticated, low-privileged database user who can execute SQL against a GIS function to corrupt server memory by supplying a deeply nested GeometryCollection to ST_AsText/AsText. Affected builds are MariaDB 10.6.1 through the fixed releases 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3 and 13.0.2; the assessed vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (the published score of 9.9 assumes a scope change that the independent assessment does not confirm). There is no confirmation of active exploitation (the issue is not in CISA KEV), but the upstream fix commit contains a public regression test that reproduces the crash and constitutes a working proof-of-concept; the reliable standalone outcome is memory corruption and denial of service, with code execution only achievable in combination with a second vulnerability.
Authenticated low-privileged users on MariaDB Server can hijack any account they can name, because GRANT PROXY mis-evaluates grantor privileges when the statement carries an IDENTIFIED (VIA) clause with an empty password. Under those conditions the server treats the statement as though no authentication clause had been supplied, checks the wrong grantor's rights, and lets the attacker set the target account's password - so an ordinary login can be escalated to full control of a privileged account. All builds from 10.6.1 up to the fixed releases 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3 and 13.0.2 are affected; no public exploit identified at time of analysis, and no user interaction is required (CVSS 8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Privilege escalation in MariaDB Server affects releases from 10.6.1 up to (but not including) 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, where the view FRM parser fails to safely encode embedded newline characters in an account name. An authenticated attacker who already holds both CREATE USER and CREATE VIEW WITH GRANT OPTION (CVSS vector PR:H, so not an anonymous path) can create a username containing forged view metadata and then create a view, causing the parser to read part of the username as security fields such as definer_host and suid and thereby escalates database privileges. No public exploit code and no confirmed active exploitation have been identified at time of analysis; the 7.2 High base score reflects a conditional, insider-style privilege-boundary bypass rather than a remote unauthenticated attack, and environments that restrict these administrative grants to trusted administrators have substantially reduced exposure.
Out-of-bounds reads and writes in MariaDB Server's binary FRM (table-definition) parser allow an attacker who can drop a crafted .frm file into the server's data directory and then cause that table to be opened to crash mysqld or potentially execute code in the server process. Affected releases are MariaDB Server from 10.6.1 up to (but not including) 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2. The published CVSS of 8.0 is driven by high confidentiality, integrity and availability impact once the parser is reached, but the independent assessment rates the practical path as local (AV:L/AC:L) with high privileges required (PR:H), since file placement in the data directory is a host/local operation rather than a remote unauthenticated one; no public exploit identified at time of analysis.
Privilege escalation in MariaDB Server (10.6.1 up to 10.6.28, 10.11.x before 10.11.19, 11.4.x before 11.4.13, 11.8.x before 11.8.9, 12.3.x before 12.3.3, and 13.0.x before 13.0.2) allows an authenticated database user holding the FILE privilege to plant a /run/mysqld/wsrep-new-cluster file when secure-file-priv permits writes into that runtime directory, which the packaged mariadb.service systemd unit subsequently consumes as an EnvironmentFile. On the next administrator-triggered restart of mariadb.service, attacker-controlled environment values are injected into the mariadbd process, escalating from the database user context onto the host/systemd layer (scope change) with full confidentiality, integrity, and availability impact. The vendor rates this 8.4 while our independent assessment uses CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H, reflecting that exploitation requires a high, non-default privilege and a restart gate; no public exploit code has been identified at time of analysis, and patched releases are already available.
An out-of-bounds stack write in the MariaDB CONNECT storage engine's DOS table type lets an authenticated user crash the server and potentially achieve code execution by supplying a crafted column definition and value. The flaw is an incorrect boundary check in the CONNECT value conversion routine that permits a one-byte null write past a stack buffer at an attacker-controlled offset (CWE-787), and it affects MariaDB from 10.6.1 up to the fixed releases 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3 and 13.0.2. Exploitation requires the non-default CONNECT engine to be installed and enabled plus privileges to create CONNECT tables of table_type 'dos' with a crafted numeric definition such as double(255,30); the vendor rates it CVSS 8.5 while the independent assessment is slightly lower (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) because authentication, a non-default engine, and high attack complexity are needed, and no public exploit code was identified at time of analysis.
RPM-based MariaDB Server packages up to the fixed releases can create the mysql service account with the database data directory as its home, allowing a database user that holds the FILE privilege to write shell startup files such as .bash_profile there. Those files only execute if an administrator later opens an interactive login shell as the mysql account, overriding its usual /sbin/nologin shell, so real-world exploitation requires both a highly privileged database account and a non-default administrator action. No public exploit has been identified at the time of analysis, Debian/Ubuntu packages are not affected because they already use /nonexistent as the account home, and the CVSS base score of 8.4 overstates the realistic likelihood given the required preconditions.
OS command injection in MariaDB Server (CWE-78) lets an attacker achieve remote code execution on Galera cluster nodes by embedding shell metacharacters in a joiner node's name, which the server passes unsanitized to the script defined in wsrep_notify_cmd. Affected branches are 10.6.1–10.6.26, 10.11.1–10.11.17, 11.4.1–11.4.11, 11.8.1–11.8.7, and 12.3.1, but only when wsrep_notify_cmd is configured. It carries a vendor CVSS of 9.8; however EPSS is very low (0.05%, 15th percentile) and SSVC marks exploitation as 'none', so there is no public exploit identified at time of analysis and it is not on CISA KEV.
Authenticated users can trigger a heap overflow in MariaDB 11.4 (before 11.4.10) and 11.8 (before 11.8.6) through the JSON_SCHEMA_VALID() function, causing denial of service and potentially remote code execution under specific memory layout conditions. The vulnerability requires valid database credentials and affects server availability and integrity across scope boundaries. No patch is currently available for vulnerable versions.
MySQL 5.5.19 and possibly other versions, and MariaDB 5.5.28a and possibly other versions, when configured to assign the FILE privilege to users who should not have administrative privileges, allows. Rated medium severity (CVSS 6.0), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 88.8%.
Path traversal in MariaDB Server (CVE-2026-44171) allows a local attacker to escape intended directory boundaries via user-interaction-driven file handling, with full confidentiality, integrity, and availability impact (CVSS 7.8). Multiple stable branches are affected, with fixes shipped in 10.6.26, 10.11.17, 11.4.11, 11.8.7, and 12.3.2; Alpine Linux has packaged the fix as mariadb 11.8.7-r0. There is no public exploit identified at time of analysis and EPSS is 0.01% (2nd percentile), indicating minimal observed exploitation interest so far.
OS command injection in MariaDB Server (fixed in Alpine package mariadb 11.8.7-r0) allows a high-privileged authenticated database user to break the trust boundary between SQL and the underlying operating system, resulting in confidentiality, integrity, and availability impact across components (scope changed). No public exploit identified at time of analysis, and EPSS exploitation probability is very low (0.07%, 22nd percentile). Tracked upstream as MariaDB MDEV-39413 with security advisory GHSA-vwf7-w26c-9w5h.
Command injection (CWE-78) in MariaDB Server affects multiple branches (10.6.x, 10.11.x, 11.4.x, 11.8.x, and 12.3.x) and allows an authenticated high-privileged user to achieve full compromise of confidentiality, integrity, and availability over the network. Alpine Linux has shipped a fixed package (mariadb 11.8.8-r0), and an upstream advisory (GHSA-7v3p-h23x-8hwv) plus MDEV-39676 track the issue, but no public exploit identified at time of analysis and EPSS is very low at 0.06%.
OS command injection in MariaDB Server (CWE-78) affects multiple supported branches (10.6.x, 10.11.x, 11.4.x, 11.8.x, 12.3.x) and allows an attacker with high database privileges to execute arbitrary operating system commands on the database host, leading to full confidentiality, integrity, and availability compromise. The flaw is tracked by Alpine, the upstream MariaDB GHSA-rpgv-q6gv-684r advisory, and MDEV-39648, with patches already released across branches. No public exploit is identified at time of analysis and EPSS is very low (0.07%, 22th percentile), so the issue is currently treated as a high-severity patch-now rather than an in-the-wild emergency.
Read-only mode in Bytebase DBHub before 0.22.6 can be bypassed on the MySQL and MariaDB connectors, allowing write and destructive DDL statements such as DROP TABLE to reach the database through the MCP execute-SQL tool. The root cause is an interpretation conflict: DBHub's scanner treats every '--' as a line comment, while MySQL and MariaDB only start a comment when whitespace follows, so a payload like 'SELECT 1--1;DROP TABLE victim' passes the read-only classifier and is still executed in full because the connectors run with multipleStatements enabled. Unauthenticated remote attackers must be able to influence the SQL the assistant issues - most realistically via prompt injection in content the assistant reads - and read-only mode must actually be enabled for the bypass to matter; a proof-of-concept payload is documented in the public advisory, no confirmed public exploit code or CISA KEV entry exists at time of analysis, and the issue is fixed in 0.22.6.
An out-of-bounds memory read in MariaDB Server's spatial (GIS) functions lets an authenticated but low-privileged database user pass a truncated WKB MultiPolygon or MultiLineString to ST_Area, ST_Centroid, or GLength and have the parser read past the end of the allocated buffer, returning adjacent heap bytes as a geometry result or error path. Affected releases are MariaDB 10.6.1 through the fixes in 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2; exploitation requires valid credentials and the ability to submit attacker-controlled spatial data (CVSS 4.3, PR:L), and the leak is primarily useful as an ASLR-bypass primitive inside a larger exploit chain rather than as a standalone compromise. No public exploit code has been identified at time of analysis and the flaw is not listed in CISA KEV, so it should be treated as low-to-moderate priority and scheduled with routine patching; the vendor advisory GHSA-p7v9-24h4-mch8 and MDEV-40328 document the issue.
Missing FILE-privilege and secure_file_priv enforcement in MariaDB Server's optional CONNECT storage engine plugin lets an authenticated, low-privileged database user read or write files on the database host through the file-access UDFs json_file(), bson_file(), jfile_make(), bfile_make(), and jbin_file(), bypassing the access controls those functions were supposed to honor. Affected releases range from 10.6.1 up to (but excluding) the fixed builds 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2; exploitation requires the CONNECT plugin to be installed and loaded (it is not part of a default MariaDB installation) plus a valid low-privileged account able to call the affected UDFs. The practical impact is bounded by the operating-system permissions of the database service account, so reachable files are limited to those the mysqld user can already read or write; no public exploit code has been identified at time of analysis, and the flaw is rated moderate (CVSS 3.1 5.4, AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) rather than an emergency.
Privilege confusion in MariaDB Server (10.6.1 through the 10.6.x, 10.11.x, 11.4.x, 11.8.x, 12.x and 13.0.x lines prior to the fixed releases) allows an authenticated attacker who already holds the CREATE USER privilege to create a principal whose name collides with an existing role or localhost user in the database-privilege ACL cache, then exercise database privileges belonging to that other account. Because roles and localhost users were both cached with an empty IP component, the cache key could resolve to the wrong principal once the legitimate account's database privileges had already been cached through normal use, matching the assessed CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N (high confidentiality and integrity impact, no availability impact). Exploitation is not reachable by unauthenticated or low-privilege users and depends on non-trivial account-naming collisions plus ACL-cache timing state, so the practical risk is concentrated in privileged insiders or already-compromised administrative accounts. Vendor-released fixes are available in 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3 and 13.0.2; no public exploit identified at time of analysis.
Credential disclosure in MariaDB Connector/C (libmariadb) 3.4.1 through 3.4.9 lets an active man-in-the-middle attacker who holds a validly-trusted certificate issued for a different hostname capture the cleartext database password: the library checked certificate trust, but failed to reject a TLS hostname mismatch before proceeding with a non-hashing authentication plugin switch, allowing the attacker to request mysql_clear_password over the attacker-controlled TLS session. Exploitation requires the client to run in Zero-Configuration SSL mode (no ssl_ca, ssl_capath, ssl_crl, ssl_crlpath, tls_fp, or tls_fp_list configured) on a non-local connection, plus a MITM position and a trusted-but-wrong-hostname certificate, so this is a genuine but conditional CWE-297 flaw rated moderate rather than urgent (CVSS 5.9, AC:H); no public exploit identified at time of analysis. It is fixed in version 3.4.10, and other MariaDB connectors are not affected.
Out-of-bounds reads in MariaDB Server's legacy mysql_json plugin can expose memory contents or crash the server when the plugin parses a specially crafted MySQL-origin table containing invalid MySQL binary JSON. The flaw affects MariaDB 10.6.1 and later branches up to (but excluding) 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, and is only reachable when tables imported from MySQL must be read through the mysql_json compatibility path - for example during ALTER TABLE ... FORCE. The CVSS vector (AV:L, PR:N, UI:R, S:U, C:L, I:N, A:L, score 4.4) confirms this is a local, interaction-driven issue rather than a remotely exploitable one; no public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and vendor patches are available.
Authenticated database users can trigger a heap out-of-bounds read in the MariaDB Server qc_info plugin (information_schema.query_cache_info), potentially disclosing adjacent process memory or crashing the server. The flaw affects MariaDB releases from 10.6.1 up to the fixed versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, and requires the optional qc_info plugin to be loaded plus an enabled query cache before a query containing embedded null bytes is cached and the query_cache_info table is then read. Rated 6.4 (Medium) with CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:L; there is no public exploit identified at time of analysis and the impact is limited to partial memory disclosure or denial of service rather than code execution.
Denial of service in MariaDB Server through large packet crashes when the caching_sha2_password authentication plugin is enabled and accounts use it, due to unbounded stack allocation in sha256_crypt_r. Authenticated remote attackers can crash the server by sending a crafted large authentication packet. MariaDB versions before 11.4.10, 11.5.0 through 11.8.5, and 12.0.0 through 12.2.1 are affected. No public exploit code or confirmed active exploitation reported at time of analysis.
MariaDB Server through version 11.8.5 fails to audit SQL statements when the server audit plugin is enabled and queries are prefixed with SQL comments (-- or #), allowing authenticated database users to execute DDL, DML, or DCL commands without logging. This bypass affects Relational Database Service, Aurora MySQL, and MariaDB deployments relying on audit logging for compliance and security monitoring. An attacker with database credentials could perform unauthorized administrative or data manipulation operations while evading audit trails.
MilleGPG5 5.7.2 contains a local privilege escalation vulnerability that allows authenticated users to modify service executable files in the MariaDB bin directory. Attackers can replace the mysqld.exe with a malicious executable, which will execute with system privileges when the computer restarts. [CVSS 7.8 HIGH]
Heap buffer overflow in CryptoLib versions prior to 1.4.3 allows a high-privileged local attacker to corrupt adjacent memory by supplying oversized hex strings in MariaDB SA fields without capacity validation. Public exploit code exists for this vulnerability affecting spacecraft communication security implementations. The flaw enables denial of service and potential code execution through heap memory manipulation.
Directory traversal in the mariadb-dump utility (part of MariaDB) allows code execution when the tool is run against a database with attacker-controlled view names. Exploitation requires the victim to invoke mariadb-dump against malicious or untrusted database content - such as a compromised server being dumped or an untrusted backup being restored - and only yields code execution at the dumping user's privilege level. The flaw (CWE-22, ZDI-CAN-27000) is scored CVSS 7.0 with high attack complexity and mandatory user interaction; EPSS is low (0.52%) and there is no KEV listing, with no public exploit identified at time of analysis.
Insecure default configuration of MariaDB replication in the YAOOK infra-operator exposes database replication traffic to interception, letting an on-path attacker read database contents that may include credentials. The affected component is the infra-operator's MariaDB replication channel, which does not adequately protect replication traffic by default (CWE-1188). Exploitation requires the attacker to already hold an adjacent-network (AV:A) position on the path between MariaDB replication peers; no database credentials or user interaction are needed, and the outcome is read-only confidentiality loss with no integrity or availability impact. Risk is moderate: EPSS is 0.18% (7th percentile), there is no CISA KEV listing, and no public exploit identified at time of analysis.
SQL injection in the Django ORM column-alias handling used by QuerySet.annotate(), QuerySet.alias(), QuerySet.aggregate(), and QuerySet.extra() affects Django 4.2 before 4.2.25, 5.1 before 5.1.13, and 5.2 before 5.2.7, but only when the application is backed by MySQL or MariaDB; PostgreSQL, SQLite, and Oracle are not affected. An attacker can only reach the flaw if the application itself expands an attacker-controlled dictionary (**kwargs) into those methods so that untrusted input becomes a column alias - a pattern that is uncommon in idiomatic Django code, which is why the independent assessment raises attack complexity to AC:H even though the published vector is 9.8/AC:L. Per the CVSS vector (PR:N/UI:N) no authentication or user interaction is required once that vulnerable code path exists, and the outcome is full read/write access to query data via injected SQL; at the time of analysis no public exploit code was identified and EPSS is negligible (0.01%, 2nd percentile), with vendor patches available. This is a follow-up to CVE-2022-28346, indicating the earlier alias denylist was incomplete.
An issue was discovered in MariaDB MCP 0.1.0 allowing attackers to gain sensitive information via the SSE service as the SSE service lacks user validation. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An issue in MariaDB v.11.1 allows a remote attacker to execute arbitrary code via the lib_mysqludf_sys.so function. Rated medium severity (CVSS 5.7), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable, low attack complexity.
A vulnerability was found in MariaDB. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An issue was discovered in MariaDB MaxScale before 23.02.3. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Vulnerability in the MySQL Server product of Oracle MySQL (component: C API). Rated medium severity (CVSS 4.4), this vulnerability is remotely exploitable.
In MariaDB before 10.9.2, compress_write in extra/mariabackup/ds_compress.cc does not release data_mutex upon a stream write failure, which allows local users to trigger a deadlock. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. No vendor patch available.
MariaDB v10.7 was discovered to contain an use-after-poison in in __interceptor_memset at /libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
MariaDB v10.5 to v10.7 was discovered to contain a segmentation fault via the component st_select_lex_unit::exclude_level. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
MariaDB v10.2 to v10.7 was discovered to contain a segmentation fault via the component Exec_time_tracker::get_loops/Filesort_tracker::report_use/filesort. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
MariaDB v10.2 to v10.7 was discovered to contain a segmentation fault via the component Item_args::walk_args. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
MariaDB v10.4 to v10.8 was discovered to contain a segmentation fault via the component Item_field::fix_outer_field. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
MariaDB v10.2 to v10.7 was discovered to contain a segmentation fault via the component Item_func_in::cleanup/Item::cleanup_processor. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
MariaDB v10.2 to v10.7 was discovered to contain a segmentation fault via the component sub_select. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
MariaDB v10.2 to v10.6.1 was discovered to contain a segmentation fault via the component Item_subselect::init_expr_cache_tracker. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
MariaDB v10.5 to v10.7 was discovered to contain an assertion failure at table->get_ref_count() == 0 in dict0dict.cc. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
MariaDB v10.4 to v10.7 was discovered to contain an use-after-poison in prepare_inplace_add_virtual at /storage/innobase/handler/handler0alter.cc. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
MariaDB Server before 10.7 is vulnerable to Denial of Service. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity.
MariaDB Server before 10.7 is vulnerable to Denial of Service. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity.
MariaDB Server before 10.7 is vulnerable to Denial of Service. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity.
MariaDB Server before 10.7 is vulnerable to Denial of Service. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity.
Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Rated medium severity (CVSS 4.4), this vulnerability is remotely exploitable. No vendor patch available.
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: FTS). Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable, low attack complexity.
MariaDB Server v10.6.3 and below was discovered to contain an use-after-free in the component my_mb_wc_latin1 at /strings/ctype-latin1.c. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
MariaDB Server v10.6.3 and below was discovered to contain an use-after-free in the component VDec::VDec at /sql/sql_type.cc. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
MariaDB Server v10.6.3 and below was discovered to contain an use-after-free in the component my_wildcmp_8bit_impl at /strings/ctype-simple.c. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
MariaDB Server v10.9 and below was discovered to contain a segmentation fault via the component sql/item_cmpfunc.cc. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
MariaDB Server v10.9 and below was discovered to contain a segmentation fault via the component sql/field_conv.cc. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
MariaDB Server v10.9 and below was discovered to contain a segmentation fault via the component sql/item_func.cc:148. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
There is an Assertion failure in MariaDB Server v10.9 and below via 'node->pcur->rel_pos == BTR_PCUR_ON' at /row/row0mysql.cc. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
MariaDB Server v10.9 and below was discovered to contain a use-after-free via the component Binary_string::free_buffer() at /sql/sql_string.h. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
MariaDB Server v10.9 and below was discovered to contain a segmentation fault via the component sql/item_cmpfunc.h. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
MariaDB Server v10.9 and below was discovered to contain a segmentation fault via the component sql/sql_window.cc. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
MariaDB Server v10.9 and below was discovered to contain a segmentation fault via the component sql/item_subselect.cc. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
MariaDB Server v10.7 and below was discovered to contain a global buffer overflow in the component decimal_bin_size, which is exploited via specially crafted SQL statements. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
MariaDB Server v10.7 and below was discovered to contain a segmentation fault via the component sql/sql_class.cc. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An issue in the component Used_tables_and_const_cache::used_tables_and_const_cache_join of MariaDB Server v10.7 and below was discovered to allow attackers to cause a Denial of Service (DoS) via. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An issue in the component Item_subselect::init_expr_cache_tracker of MariaDB Server v10.6 and below was discovered to allow attackers to cause a Denial of Service (DoS) via specially crafted SQL. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
MariaDB Server v10.6 and below was discovered to contain an use-after-free in the component my_strcasecmp_8bit, which is exploited via specially crafted SQL statements. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
MariaDB Server v10.7 and below was discovered to contain a segmentation fault via the component Item_field::used_tables/update_depend_map_for_order. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An issue in the component Field::set_default of MariaDB Server v10.6 and below was discovered to allow attackers to cause a Denial of Service (DoS) via specially crafted SQL statements. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An issue in the component my_decimal::operator= of MariaDB Server v10.6.3 and below was discovered to allow attackers to cause a Denial of Service (DoS) via specially crafted SQL statements. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An issue in the component Arg_comparator::compare_real_fixed of MariaDB Server v10.6.2 and below was discovered to allow attackers to cause a Denial of Service (DoS) via specially crafted SQL. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An issue in the component Create_tmp_table::finalize of MariaDB Server v10.7 and below was discovered to allow attackers to cause a Denial of Service (DoS) via specially crafted SQL statements. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
MariaDB Server v10.6.3 and below was discovered to contain an use-after-free in the component Item_func_in::cleanup(), which is exploited via specially crafted SQL statements. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
MariaDB Server v10.6.5 and below was discovered to contain an use-after-free in the component Item_args::walk_arg, which is exploited via specially crafted SQL statements. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The BN_mod_sqrt() function, which computes a modular square root, contains a bug that can cause it to loop forever for non-prime moduli. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
MariaDB CONNECT Storage Engine Heap-based Buffer Overflow Privilege Escalation Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity.
MariaDB CONNECT Storage Engine Format String Privilege Escalation Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity.
MariaDB CONNECT Storage Engine Use-After-Free Privilege Escalation Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. This Use After Free vulnerability could allow attackers to access freed memory to execute arbitrary code or crash the application.
MariaDB CONNECT Storage Engine Stack-based Buffer Overflow Privilege Escalation Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity.
Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Rated medium severity (CVSS 5.5), this vulnerability is remotely exploitable, low attack complexity.
Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Rated medium severity (CVSS 4.4), this vulnerability is remotely exploitable. No vendor patch available.
Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Rated medium severity (CVSS 4.4), this vulnerability is remotely exploitable. No vendor patch available.
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML). Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
An authorization bypass in MariaDB Server lets an authenticated database user who can run ALTER TABLE against a partitioned table make ALTER TABLE ... CONVERT ... PARTITION operate on table files belonging to other tables, because the user-supplied partition name is inserted into the on-disk file path without filename encoding. Successful abuse yields unauthorized reads and modifications of other tables' data, and the effect is confined to servers running affected releases (10.11.1 through 10.11.18, 11.4.1 through 11.4.12, 11.8.1 through 11.8.8, 12.3.1 through 12.3.2, and 13.0.1) with the partition plugin active, which is the default. No public exploit code was identified at time of analysis and the issue is not in CISA KEV; the vendor fix is contained in 10.11.19, 11.4.13, 11.8.9, 12.3.3 and 13.0.2, and the practical barrier is that the attacker already needs a database foothold with ALTER rights on the target table.
Unauthenticated SQL injection in Apache OFBiz 24.09 (before 24.09.08) allows a remote attacker to disclose arbitrary rows from the queried entity when the deployment is backed by MySQL or MariaDB. The flaw lives in the entity engine's generic performFind service: an ignore-case find request (_ic=Y) with a crafted value causes SqlJdbcUtil.addValueSingle to inline the EntityFunction-wrapped value into the SQL text using ANSI-only single-quote doubling, which backslash-terminated payloads defeat on MySQL/MariaDB because those dialects also honor backslash escapes, turning the WHERE clause into a tautology. Only confidentiality is impacted per the assessed vector; the default Derby datasource and PostgreSQL are explicitly not affected, EPSS is low at 0.28% (20th percentile), and no public exploit has been identified at time of analysis, although the vendor has released 24.09.08 and the issue carries an act_now priority decision.
Improper quoting during SQL serialization in MariaDB Server 10.6.1 through 10.6.27, 10.11.18, 11.4.12, 11.8.8, 12.3.2 and 13.0.1 and earlier allows a low-privileged authenticated attacker who can create a foreign-data-wrapper SERVER, USER, UDF, plugin, or trigger with crafted identifiers or option values to inject arbitrary SQL into the output of SHOW CREATE SERVER, SHOW CREATE USER, or mariadb-dump; the injected statements execute only when a privileged operator later replays that generated SQL, such as during a dump restore. Exploitation requires both a pre-existing low-privileged account (CVSS PR:L) and a victim-initiated action (UI:R), so this is a conditional, stored-injection-style threat rather than an unauthenticated remote compromise. No public exploit code has been identified at time of analysis, and the issue is fixed in MariaDB 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3 and 13.0.2.
Use-after-free in MariaDB Server's SYS_REFCURSOR handling (12.3.1 through 12.3.2, and the 13.0.x branch before 13.0.2) lets an authenticated, low-privileged database user crash the server and corrupt server memory by declaring and opening more than the default 16 SYS_REFCURSORs inside a stored routine and then fetching from one of them. The flaw is a stale-reference bug in the cursor array: when the array is reallocated to grow beyond its initial 16 slots, routine-context references still point at the freed element, and the resulting use-after-free can be leveraged for remote code execution only when chained with a second, separate vulnerability. Authentication is required (CVSS PR:L, AV:N), and no public exploit code or confirmed active exploitation has been identified at the time of analysis; the vendor CVSS of 9.9 is high, but practical impact is bounded by the narrow affected version range and the need for CREATE ROUTINE/EXECUTE privileges plus a second bug to convert memory corruption into code execution.
An out-of-bounds write in MariaDB Server's spatial WKT serialization allows an authenticated, low-privileged database user who can execute SQL against a GIS function to corrupt server memory by supplying a deeply nested GeometryCollection to ST_AsText/AsText. Affected builds are MariaDB 10.6.1 through the fixed releases 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3 and 13.0.2; the assessed vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (the published score of 9.9 assumes a scope change that the independent assessment does not confirm). There is no confirmation of active exploitation (the issue is not in CISA KEV), but the upstream fix commit contains a public regression test that reproduces the crash and constitutes a working proof-of-concept; the reliable standalone outcome is memory corruption and denial of service, with code execution only achievable in combination with a second vulnerability.
Authenticated low-privileged users on MariaDB Server can hijack any account they can name, because GRANT PROXY mis-evaluates grantor privileges when the statement carries an IDENTIFIED (VIA) clause with an empty password. Under those conditions the server treats the statement as though no authentication clause had been supplied, checks the wrong grantor's rights, and lets the attacker set the target account's password - so an ordinary login can be escalated to full control of a privileged account. All builds from 10.6.1 up to the fixed releases 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3 and 13.0.2 are affected; no public exploit identified at time of analysis, and no user interaction is required (CVSS 8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Privilege escalation in MariaDB Server affects releases from 10.6.1 up to (but not including) 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, where the view FRM parser fails to safely encode embedded newline characters in an account name. An authenticated attacker who already holds both CREATE USER and CREATE VIEW WITH GRANT OPTION (CVSS vector PR:H, so not an anonymous path) can create a username containing forged view metadata and then create a view, causing the parser to read part of the username as security fields such as definer_host and suid and thereby escalates database privileges. No public exploit code and no confirmed active exploitation have been identified at time of analysis; the 7.2 High base score reflects a conditional, insider-style privilege-boundary bypass rather than a remote unauthenticated attack, and environments that restrict these administrative grants to trusted administrators have substantially reduced exposure.
Out-of-bounds reads and writes in MariaDB Server's binary FRM (table-definition) parser allow an attacker who can drop a crafted .frm file into the server's data directory and then cause that table to be opened to crash mysqld or potentially execute code in the server process. Affected releases are MariaDB Server from 10.6.1 up to (but not including) 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2. The published CVSS of 8.0 is driven by high confidentiality, integrity and availability impact once the parser is reached, but the independent assessment rates the practical path as local (AV:L/AC:L) with high privileges required (PR:H), since file placement in the data directory is a host/local operation rather than a remote unauthenticated one; no public exploit identified at time of analysis.
Privilege escalation in MariaDB Server (10.6.1 up to 10.6.28, 10.11.x before 10.11.19, 11.4.x before 11.4.13, 11.8.x before 11.8.9, 12.3.x before 12.3.3, and 13.0.x before 13.0.2) allows an authenticated database user holding the FILE privilege to plant a /run/mysqld/wsrep-new-cluster file when secure-file-priv permits writes into that runtime directory, which the packaged mariadb.service systemd unit subsequently consumes as an EnvironmentFile. On the next administrator-triggered restart of mariadb.service, attacker-controlled environment values are injected into the mariadbd process, escalating from the database user context onto the host/systemd layer (scope change) with full confidentiality, integrity, and availability impact. The vendor rates this 8.4 while our independent assessment uses CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H, reflecting that exploitation requires a high, non-default privilege and a restart gate; no public exploit code has been identified at time of analysis, and patched releases are already available.
An out-of-bounds stack write in the MariaDB CONNECT storage engine's DOS table type lets an authenticated user crash the server and potentially achieve code execution by supplying a crafted column definition and value. The flaw is an incorrect boundary check in the CONNECT value conversion routine that permits a one-byte null write past a stack buffer at an attacker-controlled offset (CWE-787), and it affects MariaDB from 10.6.1 up to the fixed releases 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3 and 13.0.2. Exploitation requires the non-default CONNECT engine to be installed and enabled plus privileges to create CONNECT tables of table_type 'dos' with a crafted numeric definition such as double(255,30); the vendor rates it CVSS 8.5 while the independent assessment is slightly lower (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) because authentication, a non-default engine, and high attack complexity are needed, and no public exploit code was identified at time of analysis.
RPM-based MariaDB Server packages up to the fixed releases can create the mysql service account with the database data directory as its home, allowing a database user that holds the FILE privilege to write shell startup files such as .bash_profile there. Those files only execute if an administrator later opens an interactive login shell as the mysql account, overriding its usual /sbin/nologin shell, so real-world exploitation requires both a highly privileged database account and a non-default administrator action. No public exploit has been identified at the time of analysis, Debian/Ubuntu packages are not affected because they already use /nonexistent as the account home, and the CVSS base score of 8.4 overstates the realistic likelihood given the required preconditions.
OS command injection in MariaDB Server (CWE-78) lets an attacker achieve remote code execution on Galera cluster nodes by embedding shell metacharacters in a joiner node's name, which the server passes unsanitized to the script defined in wsrep_notify_cmd. Affected branches are 10.6.1–10.6.26, 10.11.1–10.11.17, 11.4.1–11.4.11, 11.8.1–11.8.7, and 12.3.1, but only when wsrep_notify_cmd is configured. It carries a vendor CVSS of 9.8; however EPSS is very low (0.05%, 15th percentile) and SSVC marks exploitation as 'none', so there is no public exploit identified at time of analysis and it is not on CISA KEV.
Authenticated users can trigger a heap overflow in MariaDB 11.4 (before 11.4.10) and 11.8 (before 11.8.6) through the JSON_SCHEMA_VALID() function, causing denial of service and potentially remote code execution under specific memory layout conditions. The vulnerability requires valid database credentials and affects server availability and integrity across scope boundaries. No patch is currently available for vulnerable versions.
MySQL 5.5.19 and possibly other versions, and MariaDB 5.5.28a and possibly other versions, when configured to assign the FILE privilege to users who should not have administrative privileges, allows. Rated medium severity (CVSS 6.0), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 88.8%.
Path traversal in MariaDB Server (CVE-2026-44171) allows a local attacker to escape intended directory boundaries via user-interaction-driven file handling, with full confidentiality, integrity, and availability impact (CVSS 7.8). Multiple stable branches are affected, with fixes shipped in 10.6.26, 10.11.17, 11.4.11, 11.8.7, and 12.3.2; Alpine Linux has packaged the fix as mariadb 11.8.7-r0. There is no public exploit identified at time of analysis and EPSS is 0.01% (2nd percentile), indicating minimal observed exploitation interest so far.
OS command injection in MariaDB Server (fixed in Alpine package mariadb 11.8.7-r0) allows a high-privileged authenticated database user to break the trust boundary between SQL and the underlying operating system, resulting in confidentiality, integrity, and availability impact across components (scope changed). No public exploit identified at time of analysis, and EPSS exploitation probability is very low (0.07%, 22nd percentile). Tracked upstream as MariaDB MDEV-39413 with security advisory GHSA-vwf7-w26c-9w5h.
Command injection (CWE-78) in MariaDB Server affects multiple branches (10.6.x, 10.11.x, 11.4.x, 11.8.x, and 12.3.x) and allows an authenticated high-privileged user to achieve full compromise of confidentiality, integrity, and availability over the network. Alpine Linux has shipped a fixed package (mariadb 11.8.8-r0), and an upstream advisory (GHSA-7v3p-h23x-8hwv) plus MDEV-39676 track the issue, but no public exploit identified at time of analysis and EPSS is very low at 0.06%.
OS command injection in MariaDB Server (CWE-78) affects multiple supported branches (10.6.x, 10.11.x, 11.4.x, 11.8.x, 12.3.x) and allows an attacker with high database privileges to execute arbitrary operating system commands on the database host, leading to full confidentiality, integrity, and availability compromise. The flaw is tracked by Alpine, the upstream MariaDB GHSA-rpgv-q6gv-684r advisory, and MDEV-39648, with patches already released across branches. No public exploit is identified at time of analysis and EPSS is very low (0.07%, 22th percentile), so the issue is currently treated as a high-severity patch-now rather than an in-the-wild emergency.
Read-only mode in Bytebase DBHub before 0.22.6 can be bypassed on the MySQL and MariaDB connectors, allowing write and destructive DDL statements such as DROP TABLE to reach the database through the MCP execute-SQL tool. The root cause is an interpretation conflict: DBHub's scanner treats every '--' as a line comment, while MySQL and MariaDB only start a comment when whitespace follows, so a payload like 'SELECT 1--1;DROP TABLE victim' passes the read-only classifier and is still executed in full because the connectors run with multipleStatements enabled. Unauthenticated remote attackers must be able to influence the SQL the assistant issues - most realistically via prompt injection in content the assistant reads - and read-only mode must actually be enabled for the bypass to matter; a proof-of-concept payload is documented in the public advisory, no confirmed public exploit code or CISA KEV entry exists at time of analysis, and the issue is fixed in 0.22.6.
An out-of-bounds memory read in MariaDB Server's spatial (GIS) functions lets an authenticated but low-privileged database user pass a truncated WKB MultiPolygon or MultiLineString to ST_Area, ST_Centroid, or GLength and have the parser read past the end of the allocated buffer, returning adjacent heap bytes as a geometry result or error path. Affected releases are MariaDB 10.6.1 through the fixes in 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2; exploitation requires valid credentials and the ability to submit attacker-controlled spatial data (CVSS 4.3, PR:L), and the leak is primarily useful as an ASLR-bypass primitive inside a larger exploit chain rather than as a standalone compromise. No public exploit code has been identified at time of analysis and the flaw is not listed in CISA KEV, so it should be treated as low-to-moderate priority and scheduled with routine patching; the vendor advisory GHSA-p7v9-24h4-mch8 and MDEV-40328 document the issue.
Missing FILE-privilege and secure_file_priv enforcement in MariaDB Server's optional CONNECT storage engine plugin lets an authenticated, low-privileged database user read or write files on the database host through the file-access UDFs json_file(), bson_file(), jfile_make(), bfile_make(), and jbin_file(), bypassing the access controls those functions were supposed to honor. Affected releases range from 10.6.1 up to (but excluding) the fixed builds 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2; exploitation requires the CONNECT plugin to be installed and loaded (it is not part of a default MariaDB installation) plus a valid low-privileged account able to call the affected UDFs. The practical impact is bounded by the operating-system permissions of the database service account, so reachable files are limited to those the mysqld user can already read or write; no public exploit code has been identified at time of analysis, and the flaw is rated moderate (CVSS 3.1 5.4, AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) rather than an emergency.
Privilege confusion in MariaDB Server (10.6.1 through the 10.6.x, 10.11.x, 11.4.x, 11.8.x, 12.x and 13.0.x lines prior to the fixed releases) allows an authenticated attacker who already holds the CREATE USER privilege to create a principal whose name collides with an existing role or localhost user in the database-privilege ACL cache, then exercise database privileges belonging to that other account. Because roles and localhost users were both cached with an empty IP component, the cache key could resolve to the wrong principal once the legitimate account's database privileges had already been cached through normal use, matching the assessed CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N (high confidentiality and integrity impact, no availability impact). Exploitation is not reachable by unauthenticated or low-privilege users and depends on non-trivial account-naming collisions plus ACL-cache timing state, so the practical risk is concentrated in privileged insiders or already-compromised administrative accounts. Vendor-released fixes are available in 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3 and 13.0.2; no public exploit identified at time of analysis.
Credential disclosure in MariaDB Connector/C (libmariadb) 3.4.1 through 3.4.9 lets an active man-in-the-middle attacker who holds a validly-trusted certificate issued for a different hostname capture the cleartext database password: the library checked certificate trust, but failed to reject a TLS hostname mismatch before proceeding with a non-hashing authentication plugin switch, allowing the attacker to request mysql_clear_password over the attacker-controlled TLS session. Exploitation requires the client to run in Zero-Configuration SSL mode (no ssl_ca, ssl_capath, ssl_crl, ssl_crlpath, tls_fp, or tls_fp_list configured) on a non-local connection, plus a MITM position and a trusted-but-wrong-hostname certificate, so this is a genuine but conditional CWE-297 flaw rated moderate rather than urgent (CVSS 5.9, AC:H); no public exploit identified at time of analysis. It is fixed in version 3.4.10, and other MariaDB connectors are not affected.
Out-of-bounds reads in MariaDB Server's legacy mysql_json plugin can expose memory contents or crash the server when the plugin parses a specially crafted MySQL-origin table containing invalid MySQL binary JSON. The flaw affects MariaDB 10.6.1 and later branches up to (but excluding) 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, and is only reachable when tables imported from MySQL must be read through the mysql_json compatibility path - for example during ALTER TABLE ... FORCE. The CVSS vector (AV:L, PR:N, UI:R, S:U, C:L, I:N, A:L, score 4.4) confirms this is a local, interaction-driven issue rather than a remotely exploitable one; no public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and vendor patches are available.
Authenticated database users can trigger a heap out-of-bounds read in the MariaDB Server qc_info plugin (information_schema.query_cache_info), potentially disclosing adjacent process memory or crashing the server. The flaw affects MariaDB releases from 10.6.1 up to the fixed versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, and requires the optional qc_info plugin to be loaded plus an enabled query cache before a query containing embedded null bytes is cached and the query_cache_info table is then read. Rated 6.4 (Medium) with CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:L; there is no public exploit identified at time of analysis and the impact is limited to partial memory disclosure or denial of service rather than code execution.
Denial of service in MariaDB Server through large packet crashes when the caching_sha2_password authentication plugin is enabled and accounts use it, due to unbounded stack allocation in sha256_crypt_r. Authenticated remote attackers can crash the server by sending a crafted large authentication packet. MariaDB versions before 11.4.10, 11.5.0 through 11.8.5, and 12.0.0 through 12.2.1 are affected. No public exploit code or confirmed active exploitation reported at time of analysis.
MariaDB Server through version 11.8.5 fails to audit SQL statements when the server audit plugin is enabled and queries are prefixed with SQL comments (-- or #), allowing authenticated database users to execute DDL, DML, or DCL commands without logging. This bypass affects Relational Database Service, Aurora MySQL, and MariaDB deployments relying on audit logging for compliance and security monitoring. An attacker with database credentials could perform unauthorized administrative or data manipulation operations while evading audit trails.
MilleGPG5 5.7.2 contains a local privilege escalation vulnerability that allows authenticated users to modify service executable files in the MariaDB bin directory. Attackers can replace the mysqld.exe with a malicious executable, which will execute with system privileges when the computer restarts. [CVSS 7.8 HIGH]
Heap buffer overflow in CryptoLib versions prior to 1.4.3 allows a high-privileged local attacker to corrupt adjacent memory by supplying oversized hex strings in MariaDB SA fields without capacity validation. Public exploit code exists for this vulnerability affecting spacecraft communication security implementations. The flaw enables denial of service and potential code execution through heap memory manipulation.
Directory traversal in the mariadb-dump utility (part of MariaDB) allows code execution when the tool is run against a database with attacker-controlled view names. Exploitation requires the victim to invoke mariadb-dump against malicious or untrusted database content - such as a compromised server being dumped or an untrusted backup being restored - and only yields code execution at the dumping user's privilege level. The flaw (CWE-22, ZDI-CAN-27000) is scored CVSS 7.0 with high attack complexity and mandatory user interaction; EPSS is low (0.52%) and there is no KEV listing, with no public exploit identified at time of analysis.
Insecure default configuration of MariaDB replication in the YAOOK infra-operator exposes database replication traffic to interception, letting an on-path attacker read database contents that may include credentials. The affected component is the infra-operator's MariaDB replication channel, which does not adequately protect replication traffic by default (CWE-1188). Exploitation requires the attacker to already hold an adjacent-network (AV:A) position on the path between MariaDB replication peers; no database credentials or user interaction are needed, and the outcome is read-only confidentiality loss with no integrity or availability impact. Risk is moderate: EPSS is 0.18% (7th percentile), there is no CISA KEV listing, and no public exploit identified at time of analysis.
SQL injection in the Django ORM column-alias handling used by QuerySet.annotate(), QuerySet.alias(), QuerySet.aggregate(), and QuerySet.extra() affects Django 4.2 before 4.2.25, 5.1 before 5.1.13, and 5.2 before 5.2.7, but only when the application is backed by MySQL or MariaDB; PostgreSQL, SQLite, and Oracle are not affected. An attacker can only reach the flaw if the application itself expands an attacker-controlled dictionary (**kwargs) into those methods so that untrusted input becomes a column alias - a pattern that is uncommon in idiomatic Django code, which is why the independent assessment raises attack complexity to AC:H even though the published vector is 9.8/AC:L. Per the CVSS vector (PR:N/UI:N) no authentication or user interaction is required once that vulnerable code path exists, and the outcome is full read/write access to query data via injected SQL; at the time of analysis no public exploit code was identified and EPSS is negligible (0.01%, 2nd percentile), with vendor patches available. This is a follow-up to CVE-2022-28346, indicating the earlier alias denylist was incomplete.
An issue was discovered in MariaDB MCP 0.1.0 allowing attackers to gain sensitive information via the SSE service as the SSE service lacks user validation. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An issue in MariaDB v.11.1 allows a remote attacker to execute arbitrary code via the lib_mysqludf_sys.so function. Rated medium severity (CVSS 5.7), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable, low attack complexity.
A vulnerability was found in MariaDB. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An issue was discovered in MariaDB MaxScale before 23.02.3. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Vulnerability in the MySQL Server product of Oracle MySQL (component: C API). Rated medium severity (CVSS 4.4), this vulnerability is remotely exploitable.
In MariaDB before 10.9.2, compress_write in extra/mariabackup/ds_compress.cc does not release data_mutex upon a stream write failure, which allows local users to trigger a deadlock. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. No vendor patch available.
MariaDB v10.7 was discovered to contain an use-after-poison in in __interceptor_memset at /libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
MariaDB v10.5 to v10.7 was discovered to contain a segmentation fault via the component st_select_lex_unit::exclude_level. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
MariaDB v10.2 to v10.7 was discovered to contain a segmentation fault via the component Exec_time_tracker::get_loops/Filesort_tracker::report_use/filesort. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
MariaDB v10.2 to v10.7 was discovered to contain a segmentation fault via the component Item_args::walk_args. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
MariaDB v10.4 to v10.8 was discovered to contain a segmentation fault via the component Item_field::fix_outer_field. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
MariaDB v10.2 to v10.7 was discovered to contain a segmentation fault via the component Item_func_in::cleanup/Item::cleanup_processor. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
MariaDB v10.2 to v10.7 was discovered to contain a segmentation fault via the component sub_select. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
MariaDB v10.2 to v10.6.1 was discovered to contain a segmentation fault via the component Item_subselect::init_expr_cache_tracker. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
MariaDB v10.5 to v10.7 was discovered to contain an assertion failure at table->get_ref_count() == 0 in dict0dict.cc. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
MariaDB v10.4 to v10.7 was discovered to contain an use-after-poison in prepare_inplace_add_virtual at /storage/innobase/handler/handler0alter.cc. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
MariaDB Server before 10.7 is vulnerable to Denial of Service. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity.
MariaDB Server before 10.7 is vulnerable to Denial of Service. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity.
MariaDB Server before 10.7 is vulnerable to Denial of Service. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity.
MariaDB Server before 10.7 is vulnerable to Denial of Service. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity.
Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Rated medium severity (CVSS 4.4), this vulnerability is remotely exploitable. No vendor patch available.
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: FTS). Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable, low attack complexity.
MariaDB Server v10.6.3 and below was discovered to contain an use-after-free in the component my_mb_wc_latin1 at /strings/ctype-latin1.c. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
MariaDB Server v10.6.3 and below was discovered to contain an use-after-free in the component VDec::VDec at /sql/sql_type.cc. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
MariaDB Server v10.6.3 and below was discovered to contain an use-after-free in the component my_wildcmp_8bit_impl at /strings/ctype-simple.c. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
MariaDB Server v10.9 and below was discovered to contain a segmentation fault via the component sql/item_cmpfunc.cc. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
MariaDB Server v10.9 and below was discovered to contain a segmentation fault via the component sql/field_conv.cc. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
MariaDB Server v10.9 and below was discovered to contain a segmentation fault via the component sql/item_func.cc:148. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
There is an Assertion failure in MariaDB Server v10.9 and below via 'node->pcur->rel_pos == BTR_PCUR_ON' at /row/row0mysql.cc. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
MariaDB Server v10.9 and below was discovered to contain a use-after-free via the component Binary_string::free_buffer() at /sql/sql_string.h. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
MariaDB Server v10.9 and below was discovered to contain a segmentation fault via the component sql/item_cmpfunc.h. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
MariaDB Server v10.9 and below was discovered to contain a segmentation fault via the component sql/sql_window.cc. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
MariaDB Server v10.9 and below was discovered to contain a segmentation fault via the component sql/item_subselect.cc. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
MariaDB Server v10.7 and below was discovered to contain a global buffer overflow in the component decimal_bin_size, which is exploited via specially crafted SQL statements. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
MariaDB Server v10.7 and below was discovered to contain a segmentation fault via the component sql/sql_class.cc. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An issue in the component Used_tables_and_const_cache::used_tables_and_const_cache_join of MariaDB Server v10.7 and below was discovered to allow attackers to cause a Denial of Service (DoS) via. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An issue in the component Item_subselect::init_expr_cache_tracker of MariaDB Server v10.6 and below was discovered to allow attackers to cause a Denial of Service (DoS) via specially crafted SQL. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
MariaDB Server v10.6 and below was discovered to contain an use-after-free in the component my_strcasecmp_8bit, which is exploited via specially crafted SQL statements. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
MariaDB Server v10.7 and below was discovered to contain a segmentation fault via the component Item_field::used_tables/update_depend_map_for_order. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An issue in the component Field::set_default of MariaDB Server v10.6 and below was discovered to allow attackers to cause a Denial of Service (DoS) via specially crafted SQL statements. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An issue in the component my_decimal::operator= of MariaDB Server v10.6.3 and below was discovered to allow attackers to cause a Denial of Service (DoS) via specially crafted SQL statements. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An issue in the component Arg_comparator::compare_real_fixed of MariaDB Server v10.6.2 and below was discovered to allow attackers to cause a Denial of Service (DoS) via specially crafted SQL. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An issue in the component Create_tmp_table::finalize of MariaDB Server v10.7 and below was discovered to allow attackers to cause a Denial of Service (DoS) via specially crafted SQL statements. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
MariaDB Server v10.6.3 and below was discovered to contain an use-after-free in the component Item_func_in::cleanup(), which is exploited via specially crafted SQL statements. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
MariaDB Server v10.6.5 and below was discovered to contain an use-after-free in the component Item_args::walk_arg, which is exploited via specially crafted SQL statements. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The BN_mod_sqrt() function, which computes a modular square root, contains a bug that can cause it to loop forever for non-prime moduli. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
MariaDB CONNECT Storage Engine Heap-based Buffer Overflow Privilege Escalation Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity.
MariaDB CONNECT Storage Engine Format String Privilege Escalation Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity.
MariaDB CONNECT Storage Engine Use-After-Free Privilege Escalation Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. This Use After Free vulnerability could allow attackers to access freed memory to execute arbitrary code or crash the application.
MariaDB CONNECT Storage Engine Stack-based Buffer Overflow Privilege Escalation Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity.
Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Rated medium severity (CVSS 5.5), this vulnerability is remotely exploitable, low attack complexity.
Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Rated medium severity (CVSS 4.4), this vulnerability is remotely exploitable. No vendor patch available.
Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Rated medium severity (CVSS 4.4), this vulnerability is remotely exploitable. No vendor patch available.
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML). Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.