CVE-2026-107816
MediumCVSS 6.4Exploitation Probability (EPSS)
Low risk22th percentile - higher than 22% of all known CVEs
Summary
MariaDB server versions from 10.6.1 to 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2 have a vulnerability in the qc_info plugin that can be confused by a query containing embedded null bytes. Reading information_schema.query_cache_info after such a query could access data beyond the end of a heap-allocated buffer, potentially disclosing adjacent memory or crashing the server.
Risk Assessment
An attack could lead to memory disclosure or denial of service, impacting confidentiality and availability.
Recommendation
Update MariaDB server to one of the fixed versions: 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, or 13.0.2.
Other vulnerabilities in MariaDB server
See all- CVE-2026-107814High
MariaDB server from 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2 RPM packages created the dedicated mysql service account with the database data directory as its home directory. A database user with the FILE privilege could write startup dot-files such as .bash_profile into $HOME, which could execute when an administrator opened a login shell for the mysql account. Debian packages are not affected because they use /nonexistent as the account home.
- CVE-2026-49261Critical
A vulnerability in MariaDB Server allows execution of arbitrary shell commands embedded in the joiner node name when `wsrep_notify_cmd` is enabled. Affected versions: 10.6.1 through 10.6.26, 10.11.1 through 10.11.17, 11.4.1 through 11.4.11, 11.8.1 through 11.8.7, and 12.3.1.
- CVE-2026-107817Medium
MariaDB server versions from 10.6.1 to 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2 have a vulnerability in the mysql_json plugin that assumes imported MySQL tables contain valid binary JSON. A specially crafted table with invalid JSON can cause out-of-bounds reads, information disclosure, or server crash.
- CVE-2026-107815High
MariaDB server from 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2 contains a vulnerability in the CONNECT engine's DOS table type where an incorrect boundary check permits a one-byte null write beyond a stack buffer at an attacker-controlled offset. An authenticated user able to use the CONNECT engine could cause a crash and potentially remote code execution.
- CVE-2026-44171Medium
MariaDB server versions from 10.6.1 to before 10.6.26, 10.11.1 to before 10.11.17, 11.4.1 to before 11.4.11, 11.8.1 to before 11.8.7, and 12.3.1 had an issue with not checking for /../ in the path when unpacking the archive. A specially crafted archive could have caused mbstream to create files outside of the target-dir path.
- CVE-2026-44169Medium
In MariaDB versions from 11.4.1 to before 11.4.11, 11.8.1 to before 11.8.7, and 12.3.1, a user with EXECUTE access to a stored routine could see the routine definition even without SHOW CREATE ROUTINE privilege. This issue has been patched in versions 11.4.11, 11.8.7, and 12.3.2.
- CVE-2026-35549Medium
In MariaDB Server before versions 11.4.10, 11.5.x-11.8.x before 11.8.6, and 12.x before 12.2.2, a vulnerability was found where a large packet can crash the server if the caching_sha2_password authentication plugin is installed and some user accounts are configured to use it. The issue is due to alloca usage in sha256_crypt_r.
Original NVD description (English source)
MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the qc_info plugin could be confused by a query containing embedded null bytes. Reading information_schema.query_cache_info after such a query was cached could access data beyond the end of a heap-allocated buffer, potentially disclosing adjacent memory or crashing the server. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS