Critical MariaDB Flaws Can Let Attackers Execute Code and Steal Database Data

MariaDB has disclosed security flaws that, under specific conditions, could let attackers run code, access restricted database tables, and steal login credentials.

The issues affect several server branches and MariaDB Connector/C. Although the headline describes a critical risk, the vendor rates the main code execution flaws as High, not Critical. Exploitation depends on installed plugins, account permissions, or unsafe settings.

The leading concern is CVE-2026-107815, a memory corruption flaw in the CONNECT storage engine. MariaDB assigns it a CVSS score of 8.5 and says researchers demonstrated remote code execution in laboratory conditions.

The advisory describes a network attack requiring low privileges, high attack complexity, and no user interaction. It does not report confirmed attacks against live systems.

The CONNECT flaw affects how it handles its DOS table. A faulty boundary check allows an attacker to write one zero byte beyond a stack buffer at an attacker-controlled position.

Even this small write can corrupt memory in a way that supports code execution, as the laboratory test showed. MariaDB recommends removing the CONNECT engine plugin when you don’t need it.

Critical MariaDB Vulnerability

A second issue, CVE-2026-107821, affects checks on binary .frm files that MariaDB reads when opening tables. Specially crafted files can cause crashes, out-of-bounds reads or writes, and potentially remote code execution. The official MariaDB advisory rates this vulnerability High with a CVSS score of 8.0.

That attack has important limits. Placing a malicious file in the database directory requires the FILE privilege and a secure-file-priv setting that permits access there.

MariaDB says properly configured servers block file-level access to this directory and grant FILE sparingly. These requirements make it misleading to describe the flaw as an unrestricted attack against every exposed server.

The separate CVE-2026-102523 vulnerability could allow attackers to read or change tables outside their normal permissions. MariaDB failed to encode partition names safely for filesystem use during ALTER TABLE … CONVERT … PARTITION operations. Its partition security advisory gives the issue a CVSS score of 8.0. It lists low privileges and user interaction as attack requirements.

Connector/C also needs attention. CVE-2026-107819 affects libmariadb versions 3.4.1 through 3.4.9. An attacker positioned between client and server could present a valid certificate for the wrong host and request cleartext password authentication.

A programming mistake could allow the client to send its password over that unverified connection. Other MariaDB connectors are not affected. The risks extend beyond server code alone.

Cybersecuritynews previously covered a cPanel database privilege flaw involving MySQL and MariaDB access, along with a PostgreSQL tool injection flaw that could enable code execution. Those separate reports provide useful context on how database permissions and supporting tools can widen an attack’s impact.

The CONNECT and binary .frm flaws affect MariaDB 10.6.1–10.6.27, 10.11.1–10.11.18, 11.4.1–11.4.12, 11.8.1–11.8.8, 12.3.1–12.3.2, and 13.0.1. Fixes are available in 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2. The partition flaw does not list the 10.6 branch as affected.

Administrators should upgrade affected server branches and update Connector/C to 3.4.10. While preparing updates, remove unused CONNECT plugins and review FILE permissions and database-directory access.

MariaDB also offers disabling partition support as a workaround for the partition flaw. Apply that measure only after checking whether existing databases depend on partitioned tables.

Update defenses against new malware as soon as it appears. Integrate TI Feeds with data from 16K SOCs.

The post Critical MariaDB Flaws Can Let Attackers Execute Code and Steal Database Data appeared first on Cyber Security News.