CVE-2026-107821
HIGH 8MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB insufficiently validated counts, offsets, lengths, and field boundaries in FRM metadata while opening binary FRM files. An attacker able to place a crafted FRM file in the data directory could trigger out-of-bounds reads or writes, crash the server, or potentially execute code. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.
Severe if exploited (CVSS 8), but no known exploitation and low modeled probability. Patch on a normal cadence.
Exploitation likelihood
1.2%chance of exploitation in 30 days · 68th percentile
Impact if exploited
8CVSS 3.1 · HIGH
- ConfidentialityHigh
- IntegrityHigh
- AvailabilityHigh
What an attacker needs
- ✓Access: Reachable over the network — no local access needed
- ⚠Privileges: Requires an admin / high-privilege account
- ✓User interaction: No user interaction needed
- ⚠Complexity: Needs a race window or specific setup
✓ lowers the bar for an attacker · ⚠ raises it
Proof of concept
No public PoC is currently catalogued.
Search for new PoCs
Search GitHub now — results may be empty or unverified.
Tracked sources are checked daily for recent CVEs, including PoCs published after the original disclosure. A later release appears after a tracked source lists it and a refresh succeeds.
Data snapshot:
Weakness (CWE)
- CWE-1285: : Improper Validation of Specified Index, Position, or Offset in Input
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
References and research data (JSON)
Vendor product assessments
Showing 32 of 273 vendor product statements; 241 omitted. Read the full vendor advisory.
mariadb10.11-0:10.11.18-4.1.hum1@aarch64 as a component of Red Hat Hardened Images · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]?arch=aarch64&distro=hummingbird-20251124&repository_id=public-hummingbird-aarch64-rpms
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
- workaround: Upgrade to the fixed version of MariaDB Server
mariadb10.11-client-utils-0:10.11.18-4.1.hum1@noarch@public-hummingbird-s390x-rpms as a component of Red Hat Hardened Images · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]?arch=noarch&distro=hummingbird-20251124&repository_id=public-hummingbird-s390x-rpms
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
- workaround: Upgrade to the fixed version of MariaDB Server
mariadb10.11-cracklib-password-check-0:10.11.18-4.1.hum1@aarch64 as a component of Red Hat Hardened Images · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]?arch=aarch64&distro=hummingbird-20251124&repository_id=public-hummingbird-aarch64-rpms
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
- workaround: Upgrade to the fixed version of MariaDB Server
mariadb10.11-embedded-0:10.11.18-4.1.hum1@x86_64 as a component of Red Hat Hardened Images · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]?arch=x86_64&distro=hummingbird-20251124&repository_id=public-hummingbird-x86_64-rpms
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
- workaround: Upgrade to the fixed version of MariaDB Server
mariadb10.11-gssapi-server-0:10.11.18-4.1.hum1@s390x as a component of Red Hat Hardened Images · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]?arch=s390x&distro=hummingbird-20251124&repository_id=public-hummingbird-s390x-rpms
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
- workaround: Upgrade to the fixed version of MariaDB Server
mariadb10.11-rocksdb-engine-0:10.11.18-4.1.hum1@x86_64 as a component of Red Hat Hardened Images · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]?arch=x86_64&distro=hummingbird-20251124&repository_id=public-hummingbird-x86_64-rpms
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
- workaround: Upgrade to the fixed version of MariaDB Server
mariadb10.11-server-galera-0:10.11.18-4.1.hum1@s390x as a component of Red Hat Hardened Images · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]?arch=s390x&distro=hummingbird-20251124&repository_id=public-hummingbird-s390x-rpms
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
- workaround: Upgrade to the fixed version of MariaDB Server
mariadb10.11-test-0:10.11.18-4.1.hum1@aarch64 as a component of Red Hat Hardened Images · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]?arch=aarch64&distro=hummingbird-20251124&repository_id=public-hummingbird-aarch64-rpms
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
- workaround: Upgrade to the fixed version of MariaDB Server
mariadb11.8-backup-0:11.8.9-0.1.hum1@aarch64 as a component of Red Hat Hardened Images · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]?arch=aarch64&distro=hummingbird-20251124&repository_id=public-hummingbird-aarch64-rpms
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
- workaround: Upgrade to the fixed version of MariaDB Server
mariadb11.8-common-0:11.8.9-0.1.hum1@noarch@public-hummingbird-x86_64-rpms as a component of Red Hat Hardened Images · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]?arch=noarch&distro=hummingbird-20251124&repository_id=public-hummingbird-x86_64-rpms
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
- workaround: Upgrade to the fixed version of MariaDB Server
mariadb11.8-devel-0:11.8.9-0.1.hum1@s390x as a component of Red Hat Hardened Images · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]?arch=s390x&distro=hummingbird-20251124&repository_id=public-hummingbird-s390x-rpms
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
- workaround: Upgrade to the fixed version of MariaDB Server
mariadb11.8-embedded-devel-0:11.8.9-0.1.hum1@s390x as a component of Red Hat Hardened Images · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]?arch=s390x&distro=hummingbird-20251124&repository_id=public-hummingbird-s390x-rpms
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
- workaround: Upgrade to the fixed version of MariaDB Server
mariadb11.8-oqgraph-engine-0:11.8.9-0.1.hum1@aarch64 as a component of Red Hat Hardened Images · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]?arch=aarch64&distro=hummingbird-20251124&repository_id=public-hummingbird-aarch64-rpms
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
- workaround: Upgrade to the fixed version of MariaDB Server
mariadb11.8-s3-engine-0:11.8.9-0.1.hum1@s390x as a component of Red Hat Hardened Images · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]?arch=s390x&distro=hummingbird-20251124&repository_id=public-hummingbird-s390x-rpms
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
- workaround: Upgrade to the fixed version of MariaDB Server
mariadb11.8-server-utils-0:11.8.9-0.1.hum1@noarch@public-hummingbird-aarch64-rpms as a component of Red Hat Hardened Images · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]?arch=noarch&distro=hummingbird-20251124&repository_id=public-hummingbird-aarch64-rpms
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
- workaround: Upgrade to the fixed version of MariaDB Server
mariadb11.8-test-0:11.8.9-0.1.hum1@x86_64 as a component of Red Hat Hardened Images · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]?arch=x86_64&distro=hummingbird-20251124&repository_id=public-hummingbird-x86_64-rpms
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
- workaround: Upgrade to the fixed version of MariaDB Server
mariadb as a component of Red Hat Enterprise Linux 10 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/mariadb
- workaround: Upgrade to the fixed version of MariaDB Server
- none available: Affected
mariadb-pam as a component of Red Hat Enterprise Linux 10 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/mariadb-pam
- workaround: Upgrade to the fixed version of MariaDB Server
- none available: Affected
mariadb11.8-devel as a component of Red Hat Enterprise Linux 10 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/mariadb11.8-devel
- workaround: Upgrade to the fixed version of MariaDB Server
- none available: Affected
mariadb11.8-test as a component of Red Hat Enterprise Linux 10 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/mariadb11.8-test
- workaround: Upgrade to the fixed version of MariaDB Server
- none available: Affected
Judy.src (mariadb-devel:10.3) as a component of Red Hat Enterprise Linux 8 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/Judy?arch=src&rpmmod=mariadb-devel:10.3
- workaround: Upgrade to the fixed version of MariaDB Server
- none available: Affected
galera (mariadb:10.11) as a component of Red Hat Enterprise Linux 8 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/galera?rpmmod=mariadb:10.11
- workaround: Upgrade to the fixed version of MariaDB Server
- none available: Affected
mariadb-devel (mariadb:10.3) as a component of Red Hat Enterprise Linux 8 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/mariadb-devel?rpmmod=mariadb:10.3
- workaround: Upgrade to the fixed version of MariaDB Server
- none available: Affected
mariadb-gssapi-server (mariadb-devel:10.3) as a component of Red Hat Enterprise Linux 8 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/mariadb-gssapi-server?rpmmod=mariadb-devel:10.3
- workaround: Upgrade to the fixed version of MariaDB Server
- none available: Affected
mariadb-server-galera (mariadb:10.11) as a component of Red Hat Enterprise Linux 8 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/mariadb-server-galera?rpmmod=mariadb:10.11
- workaround: Upgrade to the fixed version of MariaDB Server
- none available: Affected
mariadb-test (mariadb:10.3) as a component of Red Hat Enterprise Linux 8 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/mariadb-test?rpmmod=mariadb:10.3
- workaround: Upgrade to the fixed version of MariaDB Server
- none available: Affected
mariadb-backup (mariadb:11.8) as a component of Red Hat Enterprise Linux 9 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/mariadb-backup?rpmmod=mariadb:11.8
- workaround: Upgrade to the fixed version of MariaDB Server
- none available: Affected
mariadb-embedded-devel (mariadb:11.8) as a component of Red Hat Enterprise Linux 9 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/mariadb-embedded-devel?rpmmod=mariadb:11.8
- workaround: Upgrade to the fixed version of MariaDB Server
- none available: Affected
mariadb-oqgraph-engine (mariadb:11.8) as a component of Red Hat Enterprise Linux 9 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/mariadb-oqgraph-engine?rpmmod=mariadb:11.8
- workaround: Upgrade to the fixed version of MariaDB Server
- none available: Affected
mariadb-server-utils (mariadb:11.8) as a component of Red Hat Enterprise Linux 9 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/mariadb-server-utils?rpmmod=mariadb:11.8
- workaround: Upgrade to the fixed version of MariaDB Server
- none available: Affected
mariadb (mariadb:11.8) as a component of Red Hat Enterprise Linux 9 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/mariadb?rpmmod=mariadb:11.8
- workaround: Upgrade to the fixed version of MariaDB Server
- none available: Affected
mariadb.src as a component of Red Hat OpenStack Platform 13 (Queens) · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/mariadb?arch=src
- workaround: Upgrade to the fixed version of MariaDB Server
- no fix planned: Out of support scope
Unverified PoC candidates
Catalogue matches for further research. These repositories have not been validated as working exploits.
1 candidate
- https://github.com/pinebudweiser/CVE-2026-107821-PoC
The MariaDB 13.1.0 RCE LAB is a testing environment designed to validate an exploit chain that combines an OOB Read vulnerability in the share->field pointer array with multiple additional vulnerabilities, ultimately achieving arbitrary code execution with mysql privileges.
PoC-in-GitHub · CVE-2026-107821
PoC-in-GitHub · CVE-2026-107821 · Updated 2026-10-14T01:04:08Z
Known Affected Software Configurations
| Vendor | Product | Version range |
|---|---|---|
| Mariadb | Mariadb | ≥ 10.6.1 and < 10.6.28 |
| Mariadb | Mariadb | ≥ 10.11.1 and < 10.11.19 |
| Mariadb | Mariadb | ≥ 11.4.1 and < 11.4.13 |
| Mariadb | Mariadb | ≥ 11.8.1 and < 11.8.9 |
| Mariadb | Mariadb | ≥ 12.3.1 and < 12.3.3 |
| Mariadb | Mariadb | ≥ 13.0.1 and < 13.0.2 |
All CVSS metrics
- HIGH 8 v3.1 · CNA Primary
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H - HIGH 8 v3.1 · NVD Secondary
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
References
Patches & mitigations
- https://github.com/MariaDB/server/commit/3b1c2e58abab5571bec4ff52773ddc75b1738da9 CVE record · GitHub_M · Updated 2026-10-09T17:27:16.316Z
NVD · CVE-2026-107821 · Updated 2026-10-14T14:13:07.733
Red Hat · CVE-2026-107821 · Updated 2026-10-26T11:03:16+00:00
Advisories
- https://github.com/MariaDB/server/security/advisories/GHSA-c4gx-34mg-95q5 CVE record · GitHub_M · Updated 2026-10-09T17:27:16.316Z
NVD · CVE-2026-107821 · Updated 2026-10-14T14:13:07.733
Red Hat · CVE-2026-107821 · Updated 2026-10-26T11:03:16+00:00 - https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-107821.json Red Hat · CVE-2026-107821 · Updated 2026-10-26T11:03:16+00:00
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-95921 EUVD · EUVD-2026-95921
Technical & other
- https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19 CVE record · GitHub_M · Updated 2026-10-09T17:27:16.316Z
NVD · CVE-2026-107821 · Updated 2026-10-14T14:13:07.733
Red Hat · CVE-2026-107821 · Updated 2026-10-26T11:03:16+00:00 - https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28 CVE record · GitHub_M · Updated 2026-10-09T17:27:16.316Z
NVD · CVE-2026-107821 · Updated 2026-10-14T14:13:07.733
Red Hat · CVE-2026-107821 · Updated 2026-10-26T11:03:16+00:00 - https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13 CVE record · GitHub_M · Updated 2026-10-09T17:27:16.316Z
NVD · CVE-2026-107821 · Updated 2026-10-14T14:13:07.733
Red Hat · CVE-2026-107821 · Updated 2026-10-26T11:03:16+00:00 - https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9 CVE record · GitHub_M · Updated 2026-10-09T17:27:16.316Z
NVD · CVE-2026-107821 · Updated 2026-10-14T14:13:07.733
Red Hat · CVE-2026-107821 · Updated 2026-10-26T11:03:16+00:00 - https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3 CVE record · GitHub_M · Updated 2026-10-09T17:27:16.316Z
NVD · CVE-2026-107821 · Updated 2026-10-14T14:13:07.733
Red Hat · CVE-2026-107821 · Updated 2026-10-26T11:03:16+00:00 - https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2 CVE record · GitHub_M · Updated 2026-10-09T17:27:16.316Z
NVD · CVE-2026-107821 · Updated 2026-10-14T14:13:07.733
Red Hat · CVE-2026-107821 · Updated 2026-10-26T11:03:16+00:00 - https://jira.mariadb.org/browse/MDEV-40571 CVE record · GitHub_M · Updated 2026-10-09T17:27:16.316Z
NVD · CVE-2026-107821 · Updated 2026-10-14T14:13:07.733
Red Hat · CVE-2026-107821 · Updated 2026-10-26T11:03:16+00:00 - https://access.redhat.com/security/cve/CVE-2026-107821 Red Hat · CVE-2026-107821 · Updated 2026-10-26T11:03:16+00:00
- https://bugzilla.redhat.com/show_bug.cgi?id=2548734 Red Hat · CVE-2026-107821 · Updated 2026-10-26T11:03:16+00:00
- https://www.cve.org/CVERecord?id=CVE-2026-107821 Red Hat · CVE-2026-107821 · Updated 2026-10-26T11:03:16+00:00
- https://nvd.nist.gov/vuln/detail/CVE-2026-107821 Red Hat · CVE-2026-107821 · Updated 2026-10-26T11:03:16+00:00
- https://access.redhat.com/errata/RHSA-2026:83108 Red Hat · CVE-2026-107821 · Updated 2026-10-26T11:03:16+00:00
- https://access.redhat.com/errata/RHSA-2026:84689 Red Hat · CVE-2026-107821 · Updated 2026-10-26T11:03:16+00:00