CVE-2026-107817

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-107817
MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the mysql_json plugin assumed that imported MySQL tables contained valid MySQL binary JSON data. A specially prepared MySQL table containing invalid JSON data could cause out-of-bounds reads, information disclosure, or a server crash. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.

4.4 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 2.5

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact LOW

Scope UNCHANGED

References
Link Resource
https://github.com/MariaDB/server/commit/851f52470d470a96a66e0b7e5599f3b6c2e45907 Patch
https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19 Release Notes
https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28 Release Notes
https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13 Release Notes
https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9 Release Notes
https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3 Release Notes
https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2 Release Notes
https://github.com/MariaDB/server/security/advisories/GHSA-89ph-64cf-gqcc Vendor Advisory
https://jira.mariadb.org/browse/MDEV-40678 Issue Tracking
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*
cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*
cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*
cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*
cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*
cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*
History

14 Oct 2026, 14:12

Type Values Removed Values Added
References () https://github.com/MariaDB/server/commit/851f52470d470a96a66e0b7e5599f3b6c2e45907 - () https://github.com/MariaDB/server/commit/851f52470d470a96a66e0b7e5599f3b6c2e45907 - Patch
References () https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19 - () https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19 - Release Notes
References () https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28 - () https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28 - Release Notes
References () https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13 - () https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13 - Release Notes
References () https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9 - () https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9 - Release Notes
References () https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3 - () https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3 - Release Notes
References () https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2 - () https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2 - Release Notes
References () https://github.com/MariaDB/server/security/advisories/GHSA-89ph-64cf-gqcc - () https://github.com/MariaDB/server/security/advisories/GHSA-89ph-64cf-gqcc - Vendor Advisory
References () https://jira.mariadb.org/browse/MDEV-40678 - () https://jira.mariadb.org/browse/MDEV-40678 - Issue Tracking
First Time Mariadb
Mariadb mariadb
CPE cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*

09 Oct 2026, 18:17

Type Values Removed Values Added
New CVE
Information

Published : 2026-10-09 18:17

Updated : 2026-10-14 14:12

NVD link : CVE-2026-107817

Mitre link : CVE-2026-107817

CVE.ORG link : CVE-2026-107817

JSON object : View

Products Affected

mariadb

  • mariadb
CWE
CWE-125

Out-of-bounds Read