CVE-2026-107823: MariaDB: privilege escalation via incorrect view frm parsing
MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the MariaDB view FRM parser did not safely encode embedded newline characters in a username. An account with CREATE USER and CREATE VIEW WITH GRANT OPTION could create a crafted username containing additional view metadata, causing the parser to interpret part of the username as security metadata and potentially escalating database privileges. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
MariaDB Serverto a version that resolves this vulnerability.Fixed in 10.6.28 - Upgrade
Upgrade
MariaDB Serverto a version that resolves this vulnerability.Fixed in 10.11.19 - Upgrade
Upgrade
MariaDB Serverto a version that resolves this vulnerability.Fixed in 11.4.13 - Upgrade
Upgrade
MariaDB Serverto a version that resolves this vulnerability.Fixed in 11.8.9 - Upgrade
Upgrade
MariaDB Serverto a version that resolves this vulnerability.Fixed in 12.3.3 - Upgrade
Upgrade
MariaDB Serverto a version that resolves this vulnerability.Fixed in 13.0.2
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs an existing MariaDB account with both CREATE USER and CREATE VIEW WITH GRANT OPTION privileges. It is therefore primarily a risk where those administrative or delegated account-management privileges are granted to untrusted users.
Which MariaDB versions are affected and which releases contain the fix?
Affected versions begin with 10.6.1 and extend up to the fixed releases. The issue is fixed in 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.
What can be done before patching?
Restrict CREATE USER and CREATE VIEW WITH GRANT OPTION so they are not jointly available to untrusted accounts. Review accounts holding these privileges, since exploitation requires both.