Description
MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the qc_info plugin could be confused by a query containing embedded null bytes. Reading information_schema.query_cache_info after such a query was cached could access data beyond the end of a heap-allocated buffer, potentially disclosing adjacent memory or crashing the server. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.
Published: 2026-10-09
Score: 6.4 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Outbound buffer read that may disclose sensitive data or crash the server
Action: Patch immediately
AI Analysis

Impact

A query sent to the MariaDB qc_info plugin that contains an embedded null byte can cause the server to read past the end of a heap-allocated buffer. This out‑of‑bounds read may expose memory that holds sensitive data or lead to a server crash. The vulnerability is classified as a buffer overread (CWE‑125).

Affected Systems

MariaDB Server is affected. The vulnerability exists in versions 10.6.1 through 10.6.28, 10.11.1 through 10.11.19, 11.4.0 through 11.4.13, 11.8.0 through 11.8.9, 12.3.0 through 12.3.3, and 13.0.0 through 13.0.2. All of those releases are fixed in the corresponding patch releases 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.

Risk and Exploitability

The CVSS score of 6.4 indicates moderate severity. The EPSS score is not available, but the lack of a listing in the CISA KEV catalog suggests no publicly known exploits yet. However, an attacker can send a malicious query over the network with an embedded null byte to trigger the vulnerability. If successful, the attacker could read adjacent memory or cause an unmanaged crash, potentially leading to data leakage or denial of service. The risk remains present until the affected servers are updated to the patched releases.

Generated by OpenCVE AI on October 9, 2026 at 18:53 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade the MariaDB Server to the latest patched release (10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, or 13.0.2) that includes the qc_info plugin fix.
  • Disable the qc_info plugin on any servers that cannot be upgraded immediately, for example by executing `UNINSTALL PLUGIN qc_info` or setting `plugin-load = -qc_info.so` in the MariaDB configuration.
  • Implement application‑level sanitization or database configuration changes to reject queries containing embedded null bytes, thereby preventing accidental triggering of the buffer overread until the patch can be applied.

Generated by OpenCVE AI on October 9, 2026 at 18:53 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 14 Oct 2026 14:30:00 +0000

Type Values Removed Values Added
First Time appeared Mariadb mariadb
CPEs cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*
Vendors & Products Mariadb mariadb

Tue, 13 Oct 2026 22:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Sat, 10 Oct 2026 00:30:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 threat_severity

Moderate

Fri, 09 Oct 2026 18:45:00 +0000

Type Values Removed Values Added
First Time appeared Mariadb
Mariadb server
Vendors & Products Mariadb
Mariadb server

Fri, 09 Oct 2026 17:30:00 +0000

Type Values Removed Values Added
Description MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the qc_info plugin could be confused by a query containing embedded null bytes. Reading information_schema.query_cache_info after such a query was cached could access data beyond the end of a heap-allocated buffer, potentially disclosing adjacent memory or crashing the server. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.
Title MariaDB: `qc_info` plugin can do OOB reads if query contains \0
Weaknesses CWE-125
References
Metrics cvssV3_1

{'score': 6.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:L'}

Subscriptions

Mariadb Mariadb Server
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-10-13T20:27:21.152Z

Reserved: 2026-10-08T21:23:59.822Z

Link: CVE-2026-107816

cve-icon Vulnrichment

Updated: 2026-10-13T20:13:35.727Z

cve-icon NVD

Status : Analyzed

Published: 2026-10-09T18:17:03.060

Modified: 2026-10-14T14:12:42.630

Link: CVE-2026-107816

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-10-09T17:19:00Z

Links: CVE-2026-107816 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-10-09T19:00:16Z

Weaknesses