CVE-2026-32710

CRITICAL EPSS 53.8%
Published Mar 20, 20263mo ago · Modified Jun 17, 20262w ago
9.9 CVSS 3.1
Critical
Find Similar
Published Mar 20, 2026 3mo ago
Last Modified Jun 17, 2026 2w ago

Description

MariaDB server is a community developed fork of MySQL server. An authenticated user can crash MariaDB versions 11.4 before 11.4.10 and 11.8 before 11.8.6 via a bug in JSON_SCHEMA_VALID() function. Under certain conditions it might be possible to turn the crash into a remote code execution. These conditions require tight control over memory layout which is generally only attainable in a lab environment. This issue is fixed in MariaDB 11.4.10, MariaDB 11.8.6, and MariaDB 12.2.2.

CVSS Details

Base Score
9.9
Exploitability
3.1
Impact
6.0
Vector string
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Attack Vector Network
Attack Complexity Low
Privileges Required Low
User Interaction None
Scope Changed
Confidentiality High
Integrity High
Availability High

Threat Intelligence

EPSS Exploit Probability
53.8% percentile
Exploit & Patch Status
No Known Exploit
No Patch Available

Weaknesses 1

CWE-122

Affected Products 3

VendorProductVersionRange
mariadbmariadb*≥11.4.1  –  <11.4.10
mariadbmariadb*≥11.8.1  –  <11.8.6
mariadbmariadb12.1.2any

References 2

  • github.com https://github.com/MariaDB/server/security/advisories/GHSA-4rj5-2227-9wgc
    Vendor Advisory
  • jira.mariadb.org https://jira.mariadb.org/browse/MDEV-38356
    Issue TrackingVendor Advisory

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.