CVE-2026-48773 is a critical heap memory corruption vulnerability (CWE-787) in ProxySQL, affecting versions 2.0.18 through 3.0.8. The flaw exists in the handling of the first-read paths of MySQL and PostgreSQL protocols, where ProxySQL accepts an attacker-controlled oversized first packet length. This length is passed directly to the recv() function, which writes into a fixed-size 32 KB input queue, leading to an out-of-bounds write. This vulnerability can be triggered by a remote unauthenticated client before any authentication occurs. The issue is patched in ProxySQL version 3.0.9.

Successful exploitation allows a remote unauthenticated attacker to cause heap memory corruption, potentially leading to denial of service, data corruption, or arbitrary code execution within ProxySQL. The vulnerability affects confidentiality, integrity, and availability, as reflected by the CVSS score of 9.8 (critical).

A fix is available in ProxySQL version 3.0.9. Users should upgrade to version 3.0.9 or later to remediate this vulnerability. No vendor advisory content was provided to indicate alternative mitigations or temporary fixes. Until patched, restricting access to ProxySQL instances from untrusted networks may reduce exposure.