CVE-2026-107815: MariaDB: one byte OOB write in DOS tables of the CONNECT engine
MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the CONNECT engine's DOS table type used an incorrect boundary check that permitted a one-byte null write beyond a stack buffer at an attacker-controlled offset. An authenticated user able to use the CONNECT engine could cause a crash and potentially remote code execution. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
MariaDBto a version that resolves this vulnerability.Fixed in 10.6.28 - Upgrade
Upgrade
MariaDBto a version that resolves this vulnerability.Fixed in 10.11.19 - Upgrade
Upgrade
MariaDBto a version that resolves this vulnerability.Fixed in 11.4.13 - Upgrade
Upgrade
MariaDBto a version that resolves this vulnerability.Fixed in 11.8.9 - Upgrade
Upgrade
MariaDBto a version that resolves this vulnerability.Fixed in 12.3.3 - Upgrade
Upgrade
MariaDBto a version that resolves this vulnerability.Fixed in 13.0.2
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated user who is able to use MariaDB's CONNECT engine can trigger the flaw. Exploitation does not require user interaction, but the attacker must be able to use the CONNECT engine and craft input that reaches a DOS table.
What are the potential impacts?
The out-of-bounds one-byte null write can crash the MariaDB server. It may also permit remote code execution, with high confidentiality, integrity, and availability impact.
Which releases contain fixes?
The issue is fixed in MariaDB versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2. Affected release ranges begin at 10.6.1 and extend up to, but do not include, the listed fixed releases for their respective branches.