MariaDB server is a community developed fork of MySQL server. An authenticated user can crash MariaDB versions 11.4 before 11.4.10 and 11.8 before 11.8.6 via a bug in JSON_SCHEMA_VALID() function. Under certain conditions it might be possible to turn the crash into a remote code execution. These conditions require tight control over memory layout which is generally only attainable in a lab environment. This issue is fixed in MariaDB 11.4.10, MariaDB 11.8.6, and MariaDB 12.2.2.
CVSS Details
- CVSS 3.1 Base Score: 8.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade mariadb | Jul 23, 2026 | Jul 23, 2026 |
| Mariadb Mariadb | — | Upgrade MariaDB to the latest version | May 6, 2026 | Mar 20, 2026 |
| Redhat_linux | — | Upgrade mariadb11.8-server-galera-debuginfoUpgrade mariadb-pamUpgrade mariadbUpgrade mariadb11.8-server-utilsUpgrade galera-debuginfoUpgrade mariadb-oqgraph-engineUpgrade mariadb-backup-debuginfoUpgrade mariadb-server-galeraUpgrade mariadb-gssapi-serverUpgrade mariadb11.8-commonUpgrade mariadb11.8-gssapi-server-debuginfoUpgrade mariadb11.8-server-galeraUpgrade mariadb11.8-errmsgUpgrade mariadb-server-galera-debuginfoUpgrade mariadb-debugsourceUpgrade mariadb-embedded-debuginfoUpgrade mariadb11.8-backupUpgrade mariadb11.8-pamUpgrade mariadb11.8-server-debuginfoUpgrade mariadb11.8-client-utilsUpgrade mariadb11.8-backup-debuginfoUpgrade mariadb11.8-oqgraph-engineUpgrade mariadb-test-debuginfoUpgrade mariadb-errmsgUpgrade mariadb-server-utilsUpgrade mariadb11.8-develUpgrade mariadb-embedded-develUpgrade mariadb11.8-testUpgrade mariadb11.8-embedded-debuginfoUpgrade mariadb-commonUpgrade mariadb-oqgraph-engine-debuginfoUpgrade mariadb-debuginfoUpgrade mariadb11.8-embeddedUpgrade mariadb11.8-pam-debuginfoUpgrade mariadb-client-utilsUpgrade mariadb-backupUpgrade mariadb11.8-test-debuginfoUpgrade mariadb-serverUpgrade galeraUpgrade mariadb-testUpgrade galera-debugsourceUpgrade mariadb11.8-debuginfoUpgrade mariadb11.8-debugsourceUpgrade mariadb-gssapi-server-debuginfoUpgrade mariadb-develUpgrade mariadb11.8Upgrade mariadb-pam-debuginfoUpgrade mariadb11.8-embedded-develUpgrade mariadb11.8-serverUpgrade mariadb11.8-gssapi-serverUpgrade mariadb-embeddedUpgrade mariadb-server-debuginfoUpgrade mariadb11.8-oqgraph-engine-debuginfo | May 20, 2026 | Mar 20, 2026 |
| Rocky_linux | — | Upgrade mariadb11.8Upgrade mariadb-embeddedUpgrade mariadb11.8-debuginfoUpgrade mariadb11.8-gssapi-serverUpgrade mariadb-backup-debuginfoUpgrade mariadb11.8-embedded-debuginfoUpgrade mariadb11.8-embedded-develUpgrade mariadb-develUpgrade mariadb11.8-oqgraph-engine-debuginfoUpgrade mariadb11.8-pam-debuginfoUpgrade mariadb-server-debuginfoUpgrade mariadb-testUpgrade mariadb-pamUpgrade mariadb11.8-debugsourceUpgrade mariadb-pam-debuginfoUpgrade galera-debugsourceUpgrade mariadb11.8-serverUpgrade mariadb11.8-embeddedUpgrade galera-debuginfoUpgrade mariadb11.8-server-galera-debuginfoUpgrade mariadb-debuginfoUpgrade mariadb-gssapi-server-debuginfoUpgrade mariadb-embedded-develUpgrade mariadb-serverUpgrade mariadb-oqgraph-engine-debuginfoUpgrade galeraUpgrade mariadb11.8-test-debuginfoUpgrade mariadb11.8-server-debuginfoUpgrade mariadb-test-debuginfoUpgrade mariadb11.8-develUpgrade mariadb-embedded-debuginfoUpgrade mariadbUpgrade mariadb11.8-backupUpgrade mariadb-debugsourceUpgrade mariadb11.8-testUpgrade mariadb-gssapi-serverUpgrade mariadb11.8-server-galeraUpgrade mariadb-backupUpgrade mariadb-server-galeraUpgrade mariadb-oqgraph-engineUpgrade mariadb-server-galera-debuginfoUpgrade mariadb11.8-oqgraph-engineUpgrade mariadb11.8-gssapi-server-debuginfoUpgrade mariadb11.8-backup-debuginfoUpgrade mariadb11.8-pam | Jun 1, 2026 | May 28, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub