CVE-2026-44172

Vulnerability

In MariaDB server versions 3.3.18 and 3.4.8, the mysql_real_escape_string() function incorrectly handles the big5 character set when processing user-supplied input. Specifically, certain multi-byte sequences can cause the function to misinterpret the input, allowing an attacker to bypass escaping. This issue occurs when the application uses the text protocol with the big5 charset and escapes user input with mysql_real_escape_string() before constructing SQL queries [1][2].

Exploitation

An attacker does not require direct database access but must be able to supply input to an application that uses the vulnerable escaping function with the big5 character set. The attacker crafts a malicious string containing a multi-byte sequence (e.g., \xa1' + 10 -- ) that, when escaped, produces output (e.g., \xa1\' + 10 -- ) where the escape character (\) is absorbed as part of the preceding multi-byte character, leaving the single quote unescaped and breaking out of the SQL string literal [1]. The attacker then appends SQL syntax to inject additional commands into the query.

Impact

Successful exploitation allows an attacker to perform SQL injection, potentially leading to unauthorized data access, modification, or deletion. The attacker may read sensitive data from the database, alter existing records, or escalate privileges depending on the database context and permissions of the application's database user [2].

Mitigation

The issue is patched in MariaDB server versions 3.3.19 and 3.4.9 [1]. Users unable to upgrade can apply workarounds: switch the application character set from big5 to gbk, or use prepared statements instead of interpolating escaped parameters into query strings [2].