The MariaDB Native Client library (C driver) used to connect C/C++ applications to MariaDB and MySQL databases contains a SQL injection vulnerability (CVE-2026-44172). This flaw arises from improper handling of the big5 character set in the mysql_real_escape_string() function, potentially allowing SQL injection attacks. Red Hat has released updated mariadb-connector-c RPM packages (version 3.4.9-1.hum1) for Red Hat Hardened Images and Red Hat Enterprise Linux 10 to fix this issue. The advisory is classified as important severity by Red Hat Product Security.

The vulnerability allows SQL injection attacks via improper escaping of input when using the big5 character set, which could lead to unauthorized database queries or data manipulation. This impacts applications using the mariadb-connector-c library on affected Red Hat Hardened Images and Red Hat Enterprise Linux 10 systems. No known exploits in the wild have been reported at this time.

Red Hat has released updated mariadb-connector-c RPM packages (version 3.4.9-1.hum1) that fix this SQL injection vulnerability. Users should apply these updates promptly to affected systems. Detailed update instructions are available from Red Hat at https://access.redhat.com/articles/11258. There is no indication that additional mitigations are required beyond applying the official update.