CVE-2026-107821
MariaDB server is a community developed fork of MySQL server
- Risk score
- 59/100
- CVSS
- 8.0 v3.1
- Exploit chance (30 days)
- 0.8%
- Published
- 9 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB insufficiently validated counts, offsets, lengths, and field boundaries in FRM metadata while opening binary FRM files. An attacker able to place a crafted FRM file in the dat…
- Affected
- Mariadb before 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, 13.0.2
- Fix
- Upgrade Mariadb to 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3 or 13.0.2 (whichever matches your release line), or later.
- Exploitation
- No known exploitation
Why it is Yellow
- CVSS 8.0 high
References
- https://github.com/MariaDB/server/commit/3b1c2e58abab5571bec4ff52773ddc75b1738da9
- https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19
- https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28
- https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13
- https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9
- https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3
- https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2
- https://github.com/MariaDB/server/security/advisories/GHSA-c4gx-34mg-95q5
- https://jira.mariadb.org/browse/MDEV-40571
Original description
MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB insufficiently validated counts, offsets, lengths, and field boundaries in FRM metadata while opening binary FRM files. An attacker able to place a crafted FRM file in the data directory could trigger out-of-bounds reads or writes, crash the server, or potentially execute code. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.
Last activity 9 Oct 2026. Patch Forecast updates every hour.