CVE-2026-107815
published 2026-10-09CVE-2026-107815: MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the CONNECT engine's…
PriorityP261high8.5CVSS 3.1
AVNACHPRLUINSCCHIHAH
EPSS
1.38%
71.9th percentile
MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the CONNECT engine's DOS table type used an incorrect boundary check that permitted a one-byte null write beyond a stack buffer at an attacker-controlled offset. An authenticated user able to use the CONNECT engine could cause a crash and potentially remote code execution. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.
Affected
17 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| mariadb-devel_10.3 | mariadb | — | — |
| mariadb | mariadb | — | — |
| mariadb | mariadb | >= 10.11.1 < 10.11.19 | 10.11.19 |
| mariadb | mariadb | >= 10.6.1 < 10.6.28 | 10.6.28 |
| mariadb | mariadb | >= 11.4.1 < 11.4.13 | 11.4.13 |
| mariadb | mariadb | >= 11.8.1 < 11.8.9 | 11.8.9 |
| mariadb | mariadb | >= 12.3.1 < 12.3.3 | 12.3.3 |
| mariadb | mariadb | >= 13.0.1 < 13.0.2 | 13.0.2 |
| mariadb | server | — | — |
| mariadb | server | — | — |
| mariadb | server | — | — |
| mariadb | server | — | — |
| mariadb | server | — | — |
| mariadb | server | — | — |
| mariadb_10.11 | mariadb | — | — |
| mariadb_10.3 | mariadb | — | — |
| mariadb_11.8 | mariadb | — | — |
CVSS provenance
nvdv3.18.5HIGHCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
vendor_redhat8.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
MariaDB Server up to 13.0.1 CONNECT engine stack-based overflow
vuldb·2026-10-09·CVSS 8.5
CVE-2026-107815 [HIGH] MariaDB Server up to 13.0.1 CONNECT engine stack-based overflow
A vulnerability was found in MariaDB Server up to 13.0.1. It has been classified as critical. Impacted is an unknown function of the component CONNECT engine. Performing a manipulation results in stack-based buffer overflow.
This vulnerability is cataloged as CVE-2026-107815. It is possible to initiate the attack remotely. There is no exploit available.
Upgrading the affected component is recommended.
Red Hat
mariadb: mariadb: Arbitrary code execution via CONNECT engine out-of-bounds write
vendor_redhat·2026-10-09·CVSS 8.5
CVE-2026-107815 [HIGH] CWE-787 mariadb: mariadb: Arbitrary code execution via CONNECT engine out-of-bounds write
mariadb: mariadb: Arbitrary code execution via CONNECT engine out-of-bounds write
A flaw was found in MariaDB. An authenticated user with permission to use the CONNECT storage engine can exploit an incorrect boundary check when handling DOS table types to write beyond the allocated stack buffer. This flaw could lead to arbitrary code execution or cause the database server to crash, resulting in a Denial of Service (DoS).
Package: mariadb10.11 (Red Hat Enterprise Linux 10) - Affected
Package: mariadb11.8 (Red Hat Enterprise Linux 10) - Affected
Package: mariadb (Red Hat Enterprise Linux 7) - Affected
Package: mariadb:10.11/mariadb (Red Hat Enterprise Linux 8) - Affected
Package: mariadb:10.3/mariadb (Red Hat Enterprise Linux 8) - Affected
Package: mariadb-devel:10.3/mariadb (Red Hat
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-107815 mariadb11.8: mariadb: Arbitrary code execution via CONNECT engine out-of-bounds write [fedora-all]
bugzilla·2026-10-22·CVSS 8.5
CVE-2026-107815 [HIGH] CVE-2026-107815 mariadb11.8: mariadb: Arbitrary code execution via CONNECT engine out-of-bounds write [fedora-all]
CVE-2026-107815 mariadb11.8: mariadb: Arbitrary code execution via CONNECT engine out-of-bounds write [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the CONNECT engine's DOS table type used an incorrect boundary check that permitted a one-byte null write beyond a stack buffer at an attacker-controlled offset. An authenticated user able to use the CONNECT engine could cause a crash and potentially remote code execution. This issue is fixed in versions 10.6.28, 10.11.19
Bugzilla
CVE-2026-107815 mariadb10.11: mariadb: Arbitrary code execution via CONNECT engine out-of-bounds write [fedora-all]
bugzilla·2026-10-22·CVSS 8.5
CVE-2026-107815 [HIGH] CVE-2026-107815 mariadb10.11: mariadb: Arbitrary code execution via CONNECT engine out-of-bounds write [fedora-all]
CVE-2026-107815 mariadb10.11: mariadb: Arbitrary code execution via CONNECT engine out-of-bounds write [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the CONNECT engine's DOS table type used an incorrect boundary check that permitted a one-byte null write beyond a stack buffer at an attacker-controlled offset. An authenticated user able to use the CONNECT engine could cause a crash and potentially remote code execution. This issue is fixed in versions 10.6.28, 10.11.1
Bugzilla
CVE-2026-107815 mariadb12.3: mariadb: Arbitrary code execution via CONNECT engine out-of-bounds write [fedora-all]
bugzilla·2026-10-22·CVSS 8.5
CVE-2026-107815 [HIGH] CVE-2026-107815 mariadb12.3: mariadb: Arbitrary code execution via CONNECT engine out-of-bounds write [fedora-all]
CVE-2026-107815 mariadb12.3: mariadb: Arbitrary code execution via CONNECT engine out-of-bounds write [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the CONNECT engine's DOS table type used an incorrect boundary check that permitted a one-byte null write beyond a stack buffer at an attacker-controlled offset. An authenticated user able to use the CONNECT engine could cause a crash and potentially remote code execution. This issue is fixed in versions 10.6.28, 10.11.19
Hackernews
⚡ Weekly Recap: 98 Zero-Days, Rogue AI Agents, $100M Crypto Theft, 700 Supermarkets Hit and More
blogs_hackernews·2026-10-19
CVE-2026-102764 ⚡ Weekly Recap: 98 Zero-Days, Rogue AI Agents, $100M Crypto Theft, 700 Supermarkets Hit and More
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## ⚡ Weekly Recap: 98 Zero-Days, Rogue AI Agents, $100M Crypto Theft, 700 Supermarkets Hit and More
The worst problems don't always come with a warning. Sometimes they arrive through a service everyone trusts, a device someone bought, or a system nobody thought to check. By the time something looks wrong, the damage may already be done.
This week had plenty of that. Trusted connections became a problem. Hardware wasn't as safe as it looked. Old bugs found new victims, and some systems were left so exposed that breaking in barely required any effort. Even AI agents crossed lines they weren't supposed to.
Some attacks were cleve
https://github.com/MariaDB/server/commit/b369925f6855d3e1f0ebcf453492724b99fda6f8https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2https://github.com/MariaDB/server/security/advisories/GHSA-4wgx-ffg9-jrwqhttps://jira.mariadb.org/browse/MDEV-40637
2026-10-09
Published