The connector assumes the client character set is UTF‑8 and performs encoding and escaping accordingly. If the server changes character_set_client to a non‑UTF‑8 value during a session, the driver continues to read and write UTF‑8 bytes while the server interprets those bytes under the new encoding, resulting in silent data corruption and a failure of quoting or escaping logic. This flaw does not provide remote code execution or privilege escalation but can compromise data integrity and reliability of database transactions.

MariaDB Connector/J for Java is affected when its version is older than 2.7.14, 3.3.5, 3.4.3, or 3.5.9. All earlier releases that rely on the UTF‑8 assumption are vulnerable and require an upgrade to one of the listed patched versions.

The CVSS score of 5.9 places the flaw in the moderate range. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog. Exploitation is most likely possible when a trusted or malicious server issues a mid‑session change to character_set_client, or when server configuration or stored routines alter the setting. An attacker who can influence the server’s character set can trigger data corruption in the client application. The lack of a KEV listing and moderate score suggest the risk is non‑critical but still relevant for environments that rely on precise data handling.