MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the CONNECT engine's DOS table type used an incorrect boundary check that permitted a one-byte null write beyond a stack buffer at an attacker-controlled offset. An authenticated user able to use the CONNECT engine could cause a crash and potentially remote code execution. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity High

Privileges Required Low

Scope Changed

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact total

Affected Vendors & Products

Vendors Products
Mariadb
  • Mariadb
  • Server

Configuration 1 [-]

OR cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*
cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*
cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*
cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*
cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*
cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*

No data.

References
Link Providers
https://github.com/MariaDB/server/commit/b369925f6855d3e1f0ebcf453492724b99fda6f8 cve-icon cve-icon cve-icon
https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19 cve-icon cve-icon cve-icon
https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28 cve-icon cve-icon cve-icon
https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13 cve-icon cve-icon cve-icon
https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9 cve-icon cve-icon cve-icon
https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3 cve-icon cve-icon cve-icon
https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2 cve-icon cve-icon cve-icon
https://github.com/MariaDB/server/security/advisories/GHSA-4wgx-ffg9-jrwq cve-icon cve-icon cve-icon
https://jira.mariadb.org/browse/MDEV-40637 cve-icon cve-icon cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2026-107815 cve-icon
https://www.cve.org/CVERecord?id=CVE-2026-107815 cve-icon
History

Wed, 14 Oct 2026 14:30:00 +0000

Type Values Removed Values Added
First Time appeared Mariadb mariadb
CPEs cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*
Vendors & Products Mariadb mariadb

Tue, 13 Oct 2026 18:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Sat, 10 Oct 2026 00:30:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 threat_severity

Important

Fri, 09 Oct 2026 17:45:00 +0000

Type Values Removed Values Added
First Time appeared Mariadb
Mariadb server
Vendors & Products Mariadb
Mariadb server

Fri, 09 Oct 2026 16:30:00 +0000

Type Values Removed Values Added
Description MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the CONNECT engine's DOS table type used an incorrect boundary check that permitted a one-byte null write beyond a stack buffer at an attacker-controlled offset. An authenticated user able to use the CONNECT engine could cause a crash and potentially remote code execution. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.
Title MariaDB: one byte OOB write in DOS tables of the CONNECT engine
Weaknesses CWE-787
References
Metrics cvssV3_1

{'score': 8.5, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H'}
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published: 2026-10-09T16:05:49.046Z

Updated: 2026-10-13T17:01:48.035Z

Reserved: 2026-10-08T21:23:59.822Z

Link: CVE-2026-107815

cve-icon Vulnrichment

Updated: 2026-10-13T17:01:41.953Z

cve-icon NVD

Status : Analyzed

Published: 2026-10-09T17:16:45.970

Modified: 2026-10-14T14:12:37.777

Link: CVE-2026-107815

cve-icon Redhat

Severity : Important

Publid Date: 2026-10-09T16:05:49Z

Links: CVE-2026-107815 - Bugzilla