CVE-2026-48773 is a critical heap memory corruption vulnerability (CWE-787) in ProxySQL, a proxy for MySQL and PostgreSQL. Versions from 2.0.18 up to and including 3.0.8 allow a remote unauthenticated attacker to trigger an out-of-bounds write by specifying an oversized first packet length in the protocol handshake. The vulnerability arises because ProxySQL uses the attacker-controlled length directly in a recv() call to write into a fixed 32 KB input buffer, leading to heap corruption. This can result in complete compromise of confidentiality, integrity, and availability. The vulnerability is fixed in version 3.0.9.

Successful exploitation allows a remote unauthenticated attacker to cause heap memory corruption before authentication, potentially leading to arbitrary code execution or denial of service. The CVSS 3.1 score is 9.8 (critical) with full impact on confidentiality, integrity, and availability.

Upgrade ProxySQL to version 3.0.9 or later, which patches this vulnerability. No other official remediation or temporary fixes are documented. Patch status is not explicitly confirmed in vendor advisories here, but the description states version 3.0.9 fixes the issue, so upgrading is the recommended mitigation.