Critical MariaDB Flaws Allow Remote Code Execution and Data Theft

Key Takeaways

• MariaDB has disclosed multiple vulnerabilities, including critical remote code execution (RCE) and data theft flaws.
• Affected components include MariaDB server branches and MariaDB Connector/C.
• Severity ratings range from High to Critical, with exploitation often dependent on specific configurations, installed plugins, or user privileges.
• Patches are available across various affected server versions and for Connector/C.

MariaDB has announced a series of security vulnerabilities that, under particular circumstances, could empower attackers to execute arbitrary code, gain unauthorized access to database tables, and compromise user credentials.

These security issues impact several server branches of MariaDB and its Connector/C client library. While some reports highlight a critical risk, MariaDB itself rates the primary code execution flaws as High severity, not Critical. Successful exploitation is contingent on factors such as installed plugins, the attacker’s account permissions, or insecure server configurations.

Remote Code Execution Vulnerabilities

The most significant concern is identified as CVE-2026-107815, a memory corruption vulnerability residing within the CONNECT storage engine. MariaDB has assigned this flaw a CVSS score of 8.5. The vendor confirmed that researchers successfully demonstrated remote code execution in a controlled laboratory environment by exploiting this vulnerability.

According to the advisory, this network-based attack requires low privileges, features high attack complexity, and does not necessitate user interaction. Importantly, MariaDB has not reported any confirmed instances of this vulnerability being exploited in live production systems.

The CONNECT flaw specifically affects how the engine processes its DOS table. A boundary check error allows an attacker to write a single zero byte beyond a stack buffer at a location controlled by the attacker. Even this minor write operation can lead to memory corruption, which the laboratory testing proved sufficient for achieving code execution. MariaDB advises removing the CONNECT engine plugin if it is not actively used.

Another significant vulnerability, CVE-2026-107821, pertains to the validation of binary .frm files that MariaDB reads when opening tables. Maliciously crafted .frm files can induce server crashes, out-of-bounds read or write operations, and potentially lead to remote code execution. MariaDB’s official advisory classifies this as a High severity vulnerability with a CVSS score of 8.0.

However, this attack vector carries important limitations. To place a malicious file within the database directory, an attacker would need the ‘FILE’ privilege and a ‘secure-file-priv’ setting that permits file access to that specific location.

MariaDB emphasizes that properly configured servers typically restrict file-level access to the database directory and grant the ‘FILE’ privilege sparingly. These prerequisites make it inaccurate to characterize this flaw as an unrestricted attack against every exposed MariaDB server.

Privilege Escalation and Data Theft

A separate vulnerability, CVE-2026-102523, could enable attackers to read or modify database tables beyond their assigned permissions. This issue stems from MariaDB’s failure to securely encode partition names for filesystem use during ‘ALTER TABLE … CONVERT … PARTITION’ operations. The partition security advisory assigns this vulnerability a CVSS score of 8.0, noting that it requires low privileges and user interaction for exploitation.

Connector/C Client Vulnerability

The MariaDB Connector/C also requires immediate attention. CVE-2026-107819 affects libmariadb versions 3.4.1 through 3.4.9. This flaw could allow an attacker positioned between the client and server to present a valid certificate for an incorrect host and then request cleartext password authentication. A programming error in the client could then lead to the transmission of the user’s password over this unverified connection. Other MariaDB connectors are not impacted by this specific vulnerability, highlighting that the risks extend beyond server-side code alone.

Affected Versions and Patches

The CONNECT and binary .frm file vulnerabilities impact MariaDB versions 10.6.1–10.6.27, 10.11.1–10.11.18, 11.4.1–11.4.12, 11.8.1–11.8.8, 12.3.1–12.3.2, and 13.0.1. Corresponding fixes are available in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2. Notably, the partition flaw does not list the 10.6 branch as being affected.

What You Should Do

• Immediately upgrade all affected MariaDB server branches to the patched versions (10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2).
• Update MariaDB Connector/C to version 3.4.10 to mitigate the cleartext password vulnerability.
• As a pre-upgrade or temporary mitigation, remove any unused CONNECT engine plugins from your MariaDB installations.
• Review and tighten ‘FILE’ privileges for all database users, ensuring they are granted only when absolutely necessary.
• Verify that ‘secure-file-priv’ settings prevent unauthorized file-level access to database directories.
• If disabling partition support is feasible without impacting existing databases, consider it as a workaround for the partition flaw (CVE-2026-102523), but only after a thorough assessment of your database dependencies.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.