MariaDB server versions 3.3.18 and 3.4.8 incorrectly handled the big5 character set when escaping user input with mysql_real_escape_string(), permitting an attacker to inject malicious SQL. The flaw defeats the intended protection of the escape routine, allowing the attacker to read, modify, or delete data in the database, potentially compromising confidentiality and integrity of stored information. This vulnerability is categorized as a SQL injection flaw (CWE‑89).

The issue affects MariaDB server 3.3.18 and 3.4.8. Affected applications are those that take untrusted input, use mysql_real_escape_string() for escaping, and send the data to the database over the text protocol with the big5 character set. The upgrade path is to 3.3.19 or 3.4.9, where the bug is fixed.

The CVSS score of 6.9 indicates moderate severity and the EPSS score of less than 1% suggests a very low but non‑zero probability of exploitation. The vulnerability is not listed in the CISA KEV catalog, implying limited public exploitation. The likely attack vector involves an application layer interface where an attacker supplies crafted input that is not properly validated; the improper escaping can be exploited remotely through any component that delegates user input to the database using the text protocol with big5 encoding. The impact scope depends on the privileges of the database user called by the connection; if a privileged account is used, an attacker could gain full control of the database.