← Back

CVE-2026-107821

nvd nist
Published: Oct 9, 2026Modified: Oct 14, 2026

JSON object

Loading...
8.0
Vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
Exploitability: 1.3 / Impact: 6.0
Source: security-advisories@github.com (Secondary)

Description

MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB insufficiently validated counts, offsets, lengths, and field boundaries in FRM metadata while opening binary FRM files. An attacker able to place a crafted FRM file in the data directory could trigger out-of-bounds reads or writes, crash the server, or potentially execute code. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.

Affected (6)

Products: Mariadb: Mariadb
Mariadb
1 product
Mariadb
Configuration A
6 vulnerable
Vulnerable SoftwareAffected Versions
Mariadb
Mariadb
10.11.1 ≤ version < 10.11.19
Mariadb
10.6.1 ≤ version < 10.6.28
Mariadb
11.4.1 ≤ version < 11.4.13
Mariadb
11.8.1 ≤ version < 11.8.9
Mariadb
12.3.1 ≤ version < 12.3.3
Mariadb
13.0.1 ≤ version < 13.0.2

Related CWEs

CWE-1285
Improper Validation of Specified Index, Position, or Offset in Input
The product receives input that is expected to specify an index, position, or offset into an indexable resource such as a buffer or file, but it does not validate or incorrectly validates that the specified index/position/offset has the required properties.

References (9)

Source: security-advisories@github.com
Patch
Source: security-advisories@github.com
Release Notes
Source: security-advisories@github.com
Release Notes
Source: security-advisories@github.com
Release Notes
Source: security-advisories@github.com
Release Notes
Source: security-advisories@github.com
Release Notes
Source: security-advisories@github.com
Release Notes
Source: security-advisories@github.com
Vendor Advisory
Source: security-advisories@github.com
Issue Tracking

Timeline

No history available yet.