{"id":"CVE-2026-107821","published":"2026-10-09T18:17:03.860","lastModified":"2026-10-14T14:13:07.733","description":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB insufficiently validated counts, offsets, lengths, and field boundaries in FRM metadata while opening binary FRM files. An attacker able to place a crafted FRM file in the data directory could trigger out-of-bounds reads or writes, crash the server, or potentially execute code. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.","cvssScore":8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H","cwes":["CWE-1285"],"vendors":["mariadb"],"products":["mariadb"],"references":[{"url":"https://github.com/MariaDB/server/commit/3b1c2e58abab5571bec4ff52773ddc75b1738da9","tags":["Patch"]},{"url":"https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19","tags":["Release Notes"]},{"url":"https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28","tags":["Release Notes"]},{"url":"https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13","tags":["Release Notes"]},{"url":"https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9","tags":["Release Notes"]},{"url":"https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3","tags":["Release Notes"]},{"url":"https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2","tags":["Release Notes"]},{"url":"https://github.com/MariaDB/server/security/advisories/GHSA-c4gx-34mg-95q5","tags":["Vendor Advisory"]},{"url":"https://jira.mariadb.org/browse/MDEV-40571","tags":["Issue Tracking"]}],"exploitRefs":[{"url":"https://github.com/MariaDB/server/commit/3b1c2e58abab5571bec4ff52773ddc75b1738da9","tags":["Patch"]},{"url":"https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19","tags":["Release Notes"]},{"url":"https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28","tags":["Release Notes"]},{"url":"https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13","tags":["Release Notes"]},{"url":"https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9","tags":["Release Notes"]},{"url":"https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3","tags":["Release Notes"]},{"url":"https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2","tags":["Release Notes"]},{"url":"https://github.com/MariaDB/server/security/advisories/GHSA-c4gx-34mg-95q5","tags":["Vendor Advisory"]}],"hasPoc":true,"ai":{"summary":"MariaDB server fails to properly validate metadata in FRM files during binary file opening, allowing attackers with write access to the data directory to trigger out-of-bounds memory accesses that can lead to crashes or code execution.","exploitability":"Exploitation requires an attacker to place a crafted FRM file in the MariaDB data directory, making it moderately difficult but possible, especially in environments where users can write to database storage locations.","blast_radius":"If exploited, this vulnerability could affect all MariaDB instances running versions 10.6.1 through 10.6.27, 10.11.1 through 10.11.18, 11.4.1 through 11.4.12, 11.8.1 through 11.8.8, 12.3.1 through 12.3.2, and 13.0.1 or earlier, potentially leading to complete database server compromise.","remediation":"Upgrade to MariaDB 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, or 13.0.2 immediately.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["database","memory-corruption","rce"],"model":"garnet-coder","analyzedAt":"2026-10-17T08:59:09.378Z"}}