CVE-2026-44172
CriticalCVSS 9.1Exploitation Probability (EPSS)
Low risk44th percentile - higher than 44% of all known CVEs
Summary
SQL injection vulnerability in MariaDB (versions 3.3.18 and 3.4.8) despite using mysql_real_escape_string() with big5 charset. Fixed in versions 3.3.19 and 3.4.9.
Risk Assessment
An attacker can inject malicious SQL queries, leading to unauthorized database access, data theft, or modification.
Recommendation
Update MariaDB to version 3.3.19 or 3.4.9 (or later).
Original NVD description (English source)
MariaDB server is a community developed fork of MySQL server. In versions 3.3.18 and 3.4.8, an application that was taking non-validated user input, escaping it with mysql_real_escape_string() and sending it to the database using text protocol and big5 character set was vulnerable to SQL injections, even though mysql_real_escape_string() was supposed to prevent them. This issue has been patched in versions 3.3.19 and 3.4.9.