CVE-2026-107821

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-107821
MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB insufficiently validated counts, offsets, lengths, and field boundaries in FRM metadata while opening binary FRM files. An attacker able to place a crafted FRM file in the data directory could trigger out-of-bounds reads or writes, crash the server, or potentially execute code. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.

8.0 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.3 / Impact : 6.0

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References
Link Resource
https://github.com/MariaDB/server/commit/3b1c2e58abab5571bec4ff52773ddc75b1738da9 Patch
https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19 Release Notes
https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28 Release Notes
https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13 Release Notes
https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9 Release Notes
https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3 Release Notes
https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2 Release Notes
https://github.com/MariaDB/server/security/advisories/GHSA-c4gx-34mg-95q5 Vendor Advisory
https://jira.mariadb.org/browse/MDEV-40571 Issue Tracking
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*
cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*
cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*
cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*
cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*
cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*
History

14 Oct 2026, 14:13

Type Values Removed Values Added
References () https://github.com/MariaDB/server/commit/3b1c2e58abab5571bec4ff52773ddc75b1738da9 - () https://github.com/MariaDB/server/commit/3b1c2e58abab5571bec4ff52773ddc75b1738da9 - Patch
References () https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19 - () https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19 - Release Notes
References () https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28 - () https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28 - Release Notes
References () https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13 - () https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13 - Release Notes
References () https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9 - () https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9 - Release Notes
References () https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3 - () https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3 - Release Notes
References () https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2 - () https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2 - Release Notes
References () https://github.com/MariaDB/server/security/advisories/GHSA-c4gx-34mg-95q5 - () https://github.com/MariaDB/server/security/advisories/GHSA-c4gx-34mg-95q5 - Vendor Advisory
References () https://jira.mariadb.org/browse/MDEV-40571 - () https://jira.mariadb.org/browse/MDEV-40571 - Issue Tracking
First Time Mariadb
Mariadb mariadb
CPE cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*

09 Oct 2026, 18:17

Type Values Removed Values Added
New CVE
Information

Published : 2026-10-09 18:17

Updated : 2026-10-14 14:13

NVD link : CVE-2026-107821

Mitre link : CVE-2026-107821

CVE.ORG link : CVE-2026-107821

JSON object : View

Products Affected

mariadb

  • mariadb
CWE
CWE-1285

Improper Validation of Specified Index, Position, or Offset in Input