The vulnerability arises from a historical #mysql50# tablename encoding bypass that allows a table name prefixed with #mysql50# to access files under their legacy unencoded name. This bypass effectively removes normal filesystem encoding checks, enabling the attacker to trigger crashes, corrupt data, exfiltrate sensitive information, or ultimately execute arbitrary code. The weakness is a failure of proper authorization control, corresponding to CWE-706 and CWE-73.

Affected systems are MariaDB Server installations. Version ranges 10.6.1 through 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2 are impacted. The issue is mitigated in the releases 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, and later major releases.

The CVSS score of 9.9 signals an extremely high severity. Although EPSS score of 0.00725 (less than 1%) indicates a very low but nonzero exploitation probability, the lack of a public exploit and its absence from CISA KEV suggests no widespread exploitation yet, but the high severity and remote nature of the flaw — an attacker who can create a table with the #mysql50# prefix can access arbitrary files and may gain code execution — render it a critical threat. Permission to create tables is generally restricted to database administrators; thus the vulnerability is primarily a privilege‑escalation or misuse vector for users with elevated DB rights.