MariaDB Connector/R2DBC assumes that all character data exchanged with the server uses UTF‑8 encoding. If the server changes the character_set_client value mid‑session—via SET NAMES, a stored routine, a trigger, or a malicious server—the driver continues to encode and decode using UTF‑8 while the server interprets the same bytes as another charset. This charset‑confusion can corrupt data silently and may also undermine proper quoting or escaping of output, potentially enabling injection‑like payloads to be misinterpreted. Based on the description, it appears that improper encoding could potentially lead to injection‑like payloads, though this risk is not explicitly documented.

The vulnerability affects MariaDB Connector/R2DBC provided by MariaDB Corporation and the org.mariadb:r2dbc-mariadb library. All releases prior to version 1.4.1 are impacted; version 1.4.1 introduces a check that accepts only utf8, utf8mb3, or utf8mb4 after initialization, and rejects any other charset by raising an R2dbcNonTransientResourceException and closing the connection.

The CVSS score of 5.9 places the issue in a moderate severity range. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting limited known exploitation activity. However, an attacker with control over the MariaDB server or capable of acting as a man‑in‑the‑middle could trigger a charset change mid‑session, forcing the driver to continue using UTF‑8. This could lead to corrupted data. The exploit therefore requires privileged access to the database server or the ability to intercept the traffic, making it unlikely for unauthenticated external attackers but a concern for compromised or malicious insiders.