A low‑privileged attacker can exploit improper quotation of identifiers and values in MariaDB’s SHOW CREATE and mariadb‑dump utilities. By creating an object with crafted identifiers or values, the attacker injects statements into the generated SQL. When that output is re‑applied, the database executes the injected SQL, allowing arbitrary command execution within the database context. The vulnerability afflicts the server’s serialization logic, enabling classic SQL‑injection style attacks against database objects that are later dumped or recreated.

MariaDB Server versions 10.6.1 through 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2 are affected. Upgrading to the corresponding patched releases (10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, or 13.0.2 or later) resolves the issue.

The CVSS score of 7.7 indicates a high severity, with a moderate to high likelihood of exploitation given sufficient privileges. The EPSS score is not available, so the exact exploitation probability cannot be quantified. The vulnerability is not currently listed in CISA KEV. Exploitation requires the ability to create database objects; thus the attack vector is privileged via SQL CREATE actions, and the impact is confined to the database server on the affected systems.