CVE-2026-107816: MariaDB: `qc_info` plugin can do OOB reads if query contains \0
MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the qcinfo plugin could be confused by a query containing embedded null bytes. Reading informationschema.querycacheinfo after such a query was cached could access data beyond the end of a heap-allocated buffer, potentially disclosing adjacent memory or crashing the server. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
MariaDB Serverto a version that resolves this vulnerability.Fixed in 10.6.28 - Upgrade
Upgrade
MariaDB Serverto a version that resolves this vulnerability.Fixed in 10.11.19 - Upgrade
Upgrade
MariaDB Serverto a version that resolves this vulnerability.Fixed in 11.4.13 - Upgrade
Upgrade
MariaDB Serverto a version that resolves this vulnerability.Fixed in 11.8.9 - Upgrade
Upgrade
MariaDB Serverto a version that resolves this vulnerability.Fixed in 12.3.3 - Upgrade
Upgrade
MariaDB Serverto a version that resolves this vulnerability.Fixed in 13.0.2
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
MariaDB Server deployments using an affected release and the qc_info plugin are exposed. The issue requires a query containing embedded null bytes to be cached, followed by access to information_schema.query_cache_info.
What access does an attacker need?
The vulnerability has a low-privileges requirement and no user interaction requirement. An attacker needs the ability to submit a crafted query with embedded null bytes; the vulnerable read occurs when query-cache information is subsequently read.
What are the potential impacts?
Accessing information_schema.query_cache_info after the crafted query has been cached can read beyond a heap buffer. This may disclose adjacent memory or crash the MariaDB server.
Which versions contain fixes?
Fixed versions are 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2. Affected version ranges begin at 10.6.1 and extend until the listed fixed releases for their respective release lines.