MariaDB servers before the patched releases contain a heap‑based buffer overflow in the JSON_SCHEMA_VALID() function. When an authenticated user supplies a specially crafted JSON schema, the server may crash, causing a denial of service. Under very strict memory‑layout conditions the overflow could allow code execution, but achieving that requires precision typically only found in lab environments.

The vulnerability applies to MariaDB server versions 11.4.x prior to 11.4.10, 11.8.x prior to 11.8.6, and earlier 12.2.2 releases. Any MariaDB installation that has the default JSON features enabled is potentially affected, as indicated by the associated CPE entries.

The CVSS base score of 8.6 indicates high severity, but the EPSS score of less than 1 % shows a low likelihood of exploitation in the wild. An attacker must first authenticate to the database, so the attack vector is remote but requires valid credentials. The possibility of turning the crash into remote code execution is constrained by the need for specialized memory control, making widespread exploitation unlikely. Nevertheless, because the crash disrupts database service, the issue should be addressed promptly.