CVE-2026-107816: CWE-125: Out-of-bounds Read in MariaDB server

CVE-2026-107816 is an out-of-bounds read vulnerability (CWE-125) in the MariaDB server's qc_info plugin. When a query containing embedded null bytes is cached, reading information_schema.query_cache_info can access memory beyond the allocated buffer. This can lead to potential information disclosure or server crashes. The issue affects MariaDB server versions >=10.6.1 <10.6.28, >=10.11.1 <10.11.19, >=11.4.1 <11.4.13, >=11.8.1 <11.8.9, >=12.3.1 <12.3.3, and >=13.0.1 <13.0.2. Fixed versions include 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.

An attacker with the ability to submit queries containing embedded null bytes could cause the MariaDB server to read memory beyond the intended buffer boundaries. This may lead to disclosure of adjacent memory contents or cause the server to crash, impacting availability. The CVSS 3.1 score is 6.4 (medium severity), reflecting network attack vector, low attack complexity, required privileges, no user interaction, and partial confidentiality impact with availability impact.

This vulnerability has been fixed in MariaDB server versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2. Users should upgrade to these or later versions to remediate the issue. No additional mitigation steps are indicated by the vendor advisory.