Critical MariaDB Flaws Enable Code Execution and Data Theft
MariaDB has disclosed several critical vulnerabilities, including memory corruption and file handling flaws, that could allow attackers to execute code, steal data, and compromise database integrity.
MariaDB has announced the discovery of multiple significant security vulnerabilities affecting its database server and Connector/C, with potential implications ranging from remote code execution to unauthorized data access. While the vendor rates the most severe flaws as 'High' rather than 'Critical,' the potential impact on affected systems remains substantial, particularly when combined with specific configurations or installed plugins.
The most prominent vulnerability, CVE-2026-107815, resides within the CONNECT storage engine. This memory corruption flaw, rated CVSS 8.5, has been demonstrated in laboratory settings to allow remote code execution. The attack vector requires low privileges and high complexity but can be initiated over the network without user interaction. The vulnerability stems from an insufficient boundary check in how the CONNECT engine handles its DOS table, allowing a single zero byte write beyond a buffer to corrupt memory in a way that facilitates code execution.
Another critical flaw, CVE-2026-107821, involves the handling of binary .frm files, which MariaDB uses when opening tables. Specially crafted .frm files can lead to crashes, out-of-bounds read/write operations, and potentially remote code execution. This vulnerability is rated CVSS 8.0, but its exploitation is significantly limited by the requirement for the FILE privilege and a specific secure-file-priv setting that allows access to the database directory. Properly configured servers are less susceptible, as they typically restrict file-level access to this sensitive location.
A third vulnerability, CVE-2026-102523, also rated CVSS 8.0, permits unauthorized access to or modification of tables due to unsafe handling of partition names. During ALTER TABLE ... CONVERT ... PARTITION operations, MariaDB failed to properly encode partition names for filesystem use, creating an avenue for attackers to bypass intended access controls. This flaw affects specific server branches but not the 10.6 branch.
Beyond the server itself, MariaDB Connector/C is also affected by CVE-2026-107819. This vulnerability in versions 3.4.1 through 3.4.9 could allow an attacker positioned between the client and server to present a valid certificate for the wrong host and trick the client into authenticating in cleartext. This could lead to the exposure of sensitive credentials.
The affected MariaDB server branches include 10.6.1–10.6.27, 10.11.1–10.11.18, 11.4.1–11.4.12, 11.8.1–11.8.8, 12.3.1–12.3.2, and 13.0.1. Patches are available in newer versions, including 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2. Administrators are strongly advised to upgrade their affected server branches and update Connector/C to version 3.4.10. As a mitigation, MariaDB recommends removing the CONNECT engine plugin if it is not actively used and reviewing FILE privileges and database directory access controls. Disabling partition support is also a potential workaround for CVE-2026-102523, provided no existing databases rely on partitioning.
These vulnerabilities underscore the ongoing challenges in securing database systems, where complex features like storage engines and partitioning can introduce subtle yet critical security weaknesses. The combination of code execution potential and data theft risks highlights the need for diligent patching and configuration management in database environments.