CVE-2026-107816 in MariaDB
Summary
by MITRE • 10/09/2026
MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the qc_info plugin could be confused by a query containing embedded null bytes. Reading information_schema.query_cache_info after such a query was cached could access data beyond the end of a heap-allocated buffer, potentially disclosing adjacent memory or crashing the server. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/09/2026
The MariaDB server, a widely adopted community-developed fork of the MySQL database management system, contains a critical memory safety vulnerability within its query cache information plugin. This flaw affects multiple release branches, specifically versions ranging from 10.6.1 through 10.6.28, as well as subsequent releases in the 10.11, 11.4, 11.8, 12.3, and 13.0 series up to their respective patched iterations. The vulnerability stems from improper handling of input data within the qc_info plugin, which is responsible for exposing details about cached queries through the information_schema.query_cache_info interface. When a user submits a SQL query that contains embedded null bytes, the internal parsing logic fails to correctly account for string termination boundaries. This oversight leads to a scenario where subsequent reads from this schema table attempt to access memory locations beyond the allocated heap buffer associated with the cached query data.
From a technical perspective, this flaw constitutes an out-of-bounds read vulnerability, commonly classified under CWE-125 in industry standards. The root cause lies in the failure of the qc_info plugin to validate or properly truncate strings containing null characters before processing them for cache metadata generation. In C and C++ based database engines like MariaDB, embedded null bytes can prematurely terminate string operations if not explicitly handled with length-aware functions. Consequently, when a query is cached after being processed by this flawed logic, the system retains an incorrect representation of the data's extent. Later, when an administrator or application queries information_schema.query_cache_info to retrieve details about that specific cache entry, the engine reads past the end of the heap-allocated buffer. This behavior violates fundamental memory safety principles and creates a direct pathway for unauthorized memory access.
The operational impact of this vulnerability is significant due to its potential to cause both confidentiality breaches and service disruptions. An attacker with appropriate privileges can craft malicious queries designed to trigger this out-of-bounds read condition repeatedly or strategically. The immediate consequence includes the disclosure of adjacent heap memory contents, which may contain sensitive information such as other users' data, authentication tokens, internal server structures, or cryptographic keys stored in nearby memory allocations. This aligns with ATT&CK technique T1005, Data from Local System, where an adversary seeks to exfiltrate data directly from the compromised host's memory without necessarily executing arbitrary code. Furthermore, if the out-of-bounds read accesses unmapped or protected memory pages, it can trigger a segmentation fault, leading to a denial of service by crashing the MariaDB server process and interrupting availability for all connected clients.
Mitigation strategies must prioritize immediate patching as the primary defense mechanism. Administrators operating affected versions should upgrade to version 10.6.28 or later in the 10.6 branch, or equivalent patched releases in other supported branches such as 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2. These updates contain code changes that enforce strict boundary checks on query strings containing null bytes before they are processed by the qc_info plugin. In environments where immediate patching is not feasible due to compatibility constraints or testing requirements, temporary mitigations should be implemented at the application layer. This includes rigorous input validation and sanitization of all SQL queries sent to the database server to ensure that embedded null bytes are either rejected or properly escaped before execution. Additionally, deploying Web Application Firewalls with deep packet inspection capabilities can help detect and block anomalous query patterns indicative of this exploitation attempt. Regular auditing of information_schema access logs may also aid in identifying potential probing activities targeting cache metadata endpoints.