MariaDB Server: Out-of-bounds access via crafted binary FRM files

Summary

MariaDB Server versions 10.6, 10.11, 11.4, 11.8, 12.3 and 13.0 insufficiently validate counts, offsets, lengths and field boundaries in binary FRM table definition files when opening a table. An attacker who can place a crafted FRM file in the data directory can trigger out-of-bounds reads or writes, crash the server or potentially execute code. The vendor states that exploitation requires the FILE privilege and a secure_file_priv setting that allows access to the data directory, and the CVSS score is 8.0 (High).

Affected

• MariaDB Server 10.6.1 to 10.6.27
• MariaDB Server 10.11.1 to 10.11.18
• MariaDB Server 11.4.1 to 11.4.12
• MariaDB Server 11.8.1 to 11.8.8
• MariaDB Server 12.3.1 to 12.3.2
• MariaDB Server 13.0.1
• The 13.1 development series is not listed as affected or fixed by the vendor advisory; status unconfirmed.

Fixed in

• 10.6.28
• 10.11.19
• 11.4.13
• 11.8.9
• 12.3.3
• 13.0.2

Workaround

• Restrict the FILE privilege to the minimum number of accounts.
• Confirm that secure_file_priv is set to a restricted directory.
• Limit OS-level write access to the MariaDB data directory.
• No vendor-published configuration baseline beyond the advisory text is known.

Exploitation

• No exploitation in the wild is known. CISA SSVC assessment: Exploitation none, Automatable no, Technical Impact total.
• A public proof-of-concept repository exists; its claims are unverified.
• EPSS about 0.012 (Vulners aggregator).

Our recommendation

• Update MariaDB Server to the fixed version for your branch.
• Audit accounts with the FILE privilege and remove it where not required.
• Verify that secure_file_priv restricts file access.
• Prioritise systems where application accounts have FILE rights or many users can reach the database.
• Monitor the data directory for unexpected file creation or modification.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

Links to third-party sites, not checked by us – exploit code can contain malware. Only use it in isolated test environments.

• Proof of concept on GitHub (1 repositories) iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).
  pinebudweiser/CVE-2026-107821-PoC

Research sources

• GitHub Security Advisory GHSA-c4gx-34mg-95q5 github.com
• Fix commit 3b1c2e58 github.com
• MariaDB 10.6.28 release github.com
• MariaDB 10.11.19 release github.com
• MariaDB 11.4.13 release github.com
• MariaDB 11.8.9 release github.com
• MDEV-40571 (Jira) jira.mariadb.org
• Debian security tracker security-tracker.debian.org

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 21:28.