CVE-2026-107816
ADVISORY - nistSummary
MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the qc_info plugin could be confused by a query containing embedded null bytes. Reading information_schema.query_cache_info after such a query was cached could access data beyond the end of a heap-allocated buffer, potentially disclosing adjacent memory or crashing the server. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.
Common Weakness Enumeration (CWE)
Out-of-bounds Read
Out-of-bounds Read
NIST
3.1
CVSS SCORE
6.4mediumDebian
-
Ubuntu
-
CVSS SCORE
N/AmediumAmazon
-
CVSS SCORE
N/AhighAmazon
-
CVSS SCORE
N/AhighAmazon
-
CVSS SCORE
N/AhighAmazon
-
CVSS SCORE
N/AhighBitnami
BIT-mariadb-2026-107816
3.1
CVSS SCORE
6.4mediumBitnami
BIT-mariadb-min-2026-107816
3.1
CVSS SCORE
6.4mediumBitnami
BIT-mysql-client-2026-107816
3.1
CVSS SCORE
6.4mediumRed Hat
2.8
CVSS SCORE
5.4mediumminimos
MINI-5x5j-84q3-7mh9
-
minimos
MINI-c79v-xjhx-345w
-
minimos
MINI-h2p2-9527-gvwj
-
minimos
MINI-jgrj-q7ch-hpp9
-
minimos
MINI-p2fm-5fh9-63pw
-
minimos
MINI-p5c5-rr5p-gfqm
-