The vulnerability in MariaDB Connector/J allows a server to change the setting of character_set_results to a non‑UTF‑8 value without the client being aware. The connector assumes that returned bytes are UTF‑8 when decoding query results, but it does not enforce this assumption or reject changes to character_set_results. If the charset is changed, the application may interpret the bytes as UTF‑8 while the actual bytes represent a different encoding, causing out‑of‑sync decoding. This mismatch can lead the application to accept or reject data based on a decoded value that does not match the underlying bytes, thereby enabling validation or escaping bypass for checks that depend on the decoded string.

The flaw affects MariaDB Connector/J versions from 3.0.0 up to, but not including, 3.3.7, 3.4.5, and 3.5.11. These connectors are used by Java applications that interact with MariaDB or MySQL databases. Applications using a connector within this range may be vulnerable.

The CVSS score of 5.9 indicates moderate severity. The EPSS score is not disclosed, and the vulnerability is not listed in the CISA KEV catalog. Attackers may achieve exploitation by controlling the database server or by performing a man‑in‑the‑middle attack to alter result character sets. Such an attacker can cause an application to misinterpret data, potentially leading to logic bypass or validation failures. The exploit requires an attacker to affect the character set configuration on a server the application trusts.