MariaDB server versions from 10.6.1 up to but not including 10.6.28, 10.11.1 up to 10.11.19, 11.4.1 up to 11.4.13, 11.8.1 up to 11.8.9, 12.3.1 up to 12.3.3, and 13.0.1 up to 13.0.2 are affected by an SQL injection vulnerability. The issue arises because SHOW CREATE SERVER, SHOW CREATE USER, and mariadb-dump commands do not consistently quote identifiers and values when serializing SQL, allowing a low-privileged attacker to inject SQL commands via crafted object identifiers or values. This vulnerability is fixed in the stated versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.
A buffer over-read vulnerability exists in MariaDB server's ST_Area function when processing invalid WKB for MultiPolygon geometries. This occurs because the multi-polygon parser advances past a nested geometry header without verifying sufficient input remains. The flaw affects multiple MariaDB versions from 10.6.1 up to but not including 10.6.28, 10.11.1 up to 10.11.19, 11.4.1 up to 11.4.13, 11.8.1 up to 11.8.9, 12.3.1 up to 12.3.3, and 13.0.1 up to 13.0.2. A low-privileged remote attacker can exploit this to disclose memory, potentially aiding in bypassing ASLR as part of a multi-vulnerability attack chain. The issue has been fixed in the stated fixed versions.
A use-after-free vulnerability (CWE-416) exists in MariaDB server versions 12.3.1 through before 12.3.3 and 13.0.1 through before 13.0.2 in the handling of SYS_REFCURSOR. This flaw allows a low-privileged attacker to open many SYS_REFCURSORs and trigger a use-after-free condition, potentially enabling remote code execution when combined with another vulnerability. The issue is fixed in versions 12.3.3 and 13.0.2.
CVE-2026-85746 is a critical out-of-bounds write vulnerability in the MariaDB server affecting multiple versions from 10.6.1 up to but not including 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2. The flaw occurs in the ST_AsText function when converting deeply nested GeometryCollections, where recursive WKT serialization fails to properly account for buffer size, leading to memory corruption. A low-privileged remote attacker can exploit this to potentially achieve code execution when combined with another vulnerability. The issue is fixed in the specified later versions.
CVE-2026-92262 is a critical vulnerability in MariaDB server affecting multiple versions from 10.6.1 up to but not including 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2. It involves the #mysql50# prefix bypassing normal table-name filesystem encoding, allowing attackers to access files using legacy unencoded names. This can lead to crashes, data corruption, data exfiltration, or remote code execution. The issue is fixed in the specified later versions.
MariaDB server versions from 10.6.1 up to but not including 10.6.28, 10.11.1 up to 10.11.19, 11.4.1 up to 11.4.13, 11.8.1 up to 11.8.9, 12.3.1 up to 12.3.3, and 13.0.1 up to 13.0.2 contain a vulnerability in the GRANT PROXY statement. This flaw allows a low-privileged attacker who can name another account to change that account's password due to improper handling of an IDENTIFIED clause with an empty password. The issue is fixed in later versions.
A missing authorization vulnerability exists in the MariaDB server's CONNECT engine plugin file-access UDFs (json_file(), bson_file(), jfile_make(), bfile_make(), and jbin_file()) in certain versions. These functions do not enforce the FILE privilege or the secure_file_priv setting, allowing a low-privileged attacker to read or write files on the filesystem that the database account is not authorized to access, subject to OS permissions. The issue affects multiple MariaDB versions and has been fixed in later releases.
MariaDB server versions from 10.6.1 up to but not including 10.6.28, 10.11.1 up to 10.11.19, 11.4.1 up to 11.4.13, 11.8.1 up to 11.8.9, 12.3.1 up to 12.3.3, and 13.0.1 up to 13.0.2 contain a vulnerability due to improper validation of counts, offsets, lengths, and field boundaries in FRM metadata when opening binary FRM files. This can allow an attacker who can place a crafted FRM file in the data directory to cause out-of-bounds reads or writes, potentially crashing the server or executing arbitrary code. The issue is fixed in the versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.
MariaDB Connector/C versions from 3.4.1 up to but not including 3.4.10 contain a vulnerability where the TLS hostname verification mismatch is not properly rejected during Zero-Configuration SSL authentication-switch logic. This flaw allows an active man-in-the-middle attacker with a valid certificate for a different hostname to request mysql_clear_password and potentially obtain the database password over the attacker-controlled TLS connection. The issue is fixed in version 3.4.10. Other MariaDB connectors are not affected.
A vulnerability in MariaDB server's view FRM parser allows improper encoding of newline characters in usernames. This flaw affects multiple MariaDB versions from 10.6.1 up to but excluding 10.6.28, 10.11.1 up to 10.11.19, 11.4.1 up to 11.4.13, 11.8.1 up to 11.8.9, 12.3.1 up to 12.3.3, and 13.0.1 up to 13.0.2. An attacker with CREATE USER and CREATE VIEW WITH GRANT OPTION privileges could craft a username that embeds additional view metadata, causing the parser to misinterpret it as security metadata and potentially escalate privileges. The issue is fixed in the stated fixed versions.
MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB's ACL cache could generate the same database-privilege cache key for role and localhost user names that matched because both used an empty IP component. An attacker with CREATE USER could create the colliding principal and, when the original principal's database privileges were cached, exercise privileges assigned to the other account. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.
CVE-2026-107818 is a high-severity vulnerability in MariaDB server affecting multiple versions from 10.6.1 up to but not including 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2. It involves external control of system or configuration settings via the mariadb.service unit using the /run/mysqld/wsrep-new-cluster file during service restart. A database user with FILE privilege and appropriate secure-file-priv settings could create this file and inject attacker-controlled environment variables, potentially compromising confidentiality, integrity, and availability. The issue is fixed in the stated versions.
MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the mysql_json plugin assumed that imported MySQL tables contained valid MySQL binary JSON data. A specially prepared MySQL table containing invalid JSON data could cause out-of-bounds reads, information disclosure, or a server crash. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.
CVE-2026-107816 is an out-of-bounds read vulnerability in the MariaDB server's qc_info plugin affecting multiple versions from 10.6.1 through versions prior to 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2. The flaw occurs when a query containing embedded null bytes is cached, and subsequent reading of information_schema.query_cache_info may access memory beyond the allocated buffer, potentially disclosing adjacent memory or causing a server crash. The issue has been fixed in the specified later versions.
MariaDB server versions from 10.6.1 up to but excluding 10.6.28, 10.11.1 up to 10.11.19, 11.4.1 up to 11.4.13, 11.8.1 up to 11.8.9, 12.3.1 up to 12.3.3, and 13.0.1 up to 13.0.2 have a vulnerability where the mysql service account's home directory is set to the database data directory. This allows a database user with FILE privilege to write startup dot-files such as .bash_profile that execute when an administrator opens a login shell for the mysql account. Debian packages are not affected due to using /nonexistent as the home directory. The issue is fixed in the listed fixed versions.
An out-of-bounds write vulnerability exists in the MariaDB server's CONNECT engine DOS table type in certain versions. This flaw allows an authenticated user with CONNECT engine access to write a null byte beyond a stack buffer boundary, potentially causing a crash or remote code execution. The issue affects multiple MariaDB versions starting from 10.6.1 up to but not including fixed versions such as 10.6.28 and others. The vulnerability has a high severity score of 8.5 and is addressed in specific patched versions.
MariaDB Connector/Node.js versions prior to 3.2.5, 3.3.4, 3.4.7, and 3.5.4 contain a SQL injection vulnerability due to improper escaping of special characters in text-protocol mode when the NO_BACKSLASH_ESCAPES SQL mode is enabled. This allows an attacker to inject arbitrary SQL commands by closing string literals improperly. The vulnerability does not affect execute() and batch() methods that use binary protocols. Fixed versions have been released to address this issue.
MariaDB Connector/Node.js versions from 3.2.0 up to but not including 3.2.5, 3.3.0 up to 3.3.4, 3.4.0 up to 3.4.7, and 3.5.0-rc.0 up to 3.5.4 contain a SQL injection vulnerability when the permitSetMultiParamEntries option is enabled. This flaw allows attacker-controlled keys with backticks to inject arbitrary SQL commands, potentially modifying unintended database columns and executing commands with the database user's privileges. The option is disabled by default, and serialized-object handling when disabled is not affected. The issue is fixed in versions 3.2.5, 3.3.4, 3.4.7, and 3.5.4.
MariaDB Connector/Node.js versions prior to 3.2.5, 3.3.4, 3.4.7, and 3.5.4 contain a vulnerability where malformed GeoJSON Polygon and MultiPolygon data can cause uninitialized Node.js heap memory to be disclosed in database values. This occurs because the connector allocates buffer space based on an unchecked numeric length before verifying the ring is an array, leading to potential exposure of sensitive information such as other users' data, session material, database credentials, or TLS key material. The issue is fixed in the specified versions.
A vulnerability in mariadb-connector-nodejs versions 3.3.0 up to but not including 3.5.4 causes an uncaught exception during zero-configuration TLS authentication using the client_ed25519 plugin. This results in a denial of service where the Node.js client process crashes and exits. The issue arises because the Ed25519PasswordAuth.hash() method references an undefined variable, causing a ReferenceError. No credentials or data are exposed, but availability is impacted. The flaw can be triggered by an attacker capable of intercepting the connection and presenting a self-signed certificate. The vulnerability is fixed in version 3.5.4. Workarounds include providing the server certificate to the client or using other authentication plugins.