CVE-2026-107815 in Server
Summary
by MITRE • 10/09/2026
MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the CONNECT engine's DOS table type used an incorrect boundary check that permitted a one-byte null write beyond a stack buffer at an attacker-controlled offset. An authenticated user able to use the CONNECT engine could cause a crash and potentially remote code execution. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/09/2026
The MariaDB server, a widely deployed community-developed fork of the MySQL database management system, contains a critical memory safety vulnerability within its CONNECT engine's DOS table type implementation. This flaw affects specific versions including those from the 10.6 series up to and excluding 10.6.28, as well as subsequent releases in the 10.11, 11.4, 11.8, 12.3, and 13.0 branches prior to their respective patch versions. The vulnerability stems from an incorrect boundary check within the code responsible for handling data operations on DOS formatted tables. Specifically, when processing certain inputs, the application fails to properly validate array indices or buffer offsets before writing data to memory. This logical error results in a one-byte null write that occurs beyond the allocated stack buffer at an attacker-controlled offset. Such out-of-bounds writes are particularly dangerous because they can corrupt adjacent memory structures on the call stack, potentially overwriting return addresses or function pointers critical for program execution flow.
From a technical perspective, this vulnerability is classified under CWE-122, which denotes heap-based buffer overflow, although in this specific instance it manifests as a stack-based out-of-bounds write due to the location of the affected variable. The root cause lies in insufficient validation of user-supplied input before performing memory operations. An authenticated attacker who has access to use the CONNECT engine can craft malicious queries or table definitions that exploit this boundary check failure. By carefully controlling the offset, the attacker can manipulate the stack layout during query execution. While the immediate observable effect is often a server crash leading to a denial of service condition where database availability is compromised, the underlying memory corruption presents a significantly higher risk. If an attacker can precisely control the overwritten bytes and the surrounding memory state, they may achieve remote code execution by redirecting program flow to malicious shellcode or leveraging existing gadgets within the binary.
The operational impact of this vulnerability extends beyond simple service disruption. Because it requires authentication, the threat actor must first gain valid credentials for the MariaDB instance. However, in many enterprise environments where database access is granted to application accounts with varying levels of privilege, even limited SQL execution capabilities can be leveraged if the CONNECT engine is enabled and accessible. The ability to cause a crash allows an attacker to perform denial-of-service attacks against critical data infrastructure. More critically, the potential for remote code execution means that compromising this vulnerability could lead to full system compromise depending on the privileges under which the MariaDB server process runs. If the database service operates with elevated permissions or access to sensitive files, successful exploitation could result in unauthorized data exfiltration, persistence mechanisms being installed, or lateral movement within the network infrastructure.
Mitigation strategies primarily involve upgrading to patched versions of MariaDB as soon as possible. The vulnerability has been resolved in version 10.6.28 and later for that branch, along with updates to 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2. Organizations should verify their current MariaDB version against these release notes and apply the appropriate patch through standard update procedures. In environments where immediate upgrading is not feasible due to compatibility concerns or maintenance windows, administrators should consider disabling the CONNECT engine if it is not actively required for business operations. This reduces the attack surface by removing access to the vulnerable code path entirely. Additionally, implementing strict network segmentation to limit database access to trusted application servers and enforcing strong authentication policies can help mitigate the risk of exploitation by unauthorized users who might otherwise attempt to leverage this flaw after gaining initial foothold credentials.
This vulnerability aligns with ATT&CK techniques related to privilege escalation and execution via database services. Specifically, it relates to T1059 Command Line Interface as attackers may use SQL commands to trigger the exploit, and potentially T1203 Exploitation for Client Execution if remote code execution is achieved. Security teams should monitor logs for unusual query patterns involving DOS table types or CONNECT engine operations that might indicate probing activity. Regular vulnerability scanning of database components and keeping all software dependencies up to date are essential practices in maintaining the integrity and availability of data-centric applications. The fix provided by MariaDB Corporation addresses the boundary check logic, ensuring that memory writes remain within allocated stack limits regardless of user input values.