TI-2026-70106 Aliases CVE-2026-107816

Out-of-bounds read in MariaDB server qc_info plugin

LOW 28CWE-125Published 2026-10-09 · Updated 2026-10-13

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: Low · None · Low
Fix status: Partial Red Hat: 1 fixed, 5 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat.

Summary

MariaDB server versions from 10.6.1 before 10.6.28, from 10.11.1 before 10.11.19, from 11.4.1 before 11.4.13, from 11.8.1 before 11.8.9, from 12.3.1 before 12.3.3 and from 13.0.1 before 13.0.2 are affected. The qc_info plugin mishandles queries with embedded null bytes, causing an out-of-bounds read (CWE-125). An authenticated remote user with low privileges can read query_cache_info to disclose adjacent memory or crash the server.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the qc_info plugin could be confused by a query containing embedded null bytes. Reading information_schema.query_cache_info after such a query was cached could access data beyond the end of a heap-allocated buffer, potentially disclosing adjacent memory or crashing the server. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00345 28th percentileScored 2026-11-07

Fix Partial server (MariaDB): 10.6.28, 10.11.19, 11.4.13 +3Red Hat: 2 advisoriesRed Hat: 1 fixed, 5 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
MariaDB	server	10.6.1 to before 10.6.28; 10.11.1 to before 10.11.19; 11.4.1 to before 11.4.13; 11.8.1 to before 11.8.9; 12.3.1 to before 12.3.3; 13.0.1 to before 13.0.2	10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, 13.0.2	Patch available	CNA

server VendorMariaDB Affected 10.6.1 to before 10.6.28; 10.11.1 to before 10.11.19; 11.4.1 to before 11.4.13; 11.8.1 to before 11.8.9; 12.3.1 to before 12.3.3; 13.0.1 to before 13.0.2 Fixed in 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, 13.0.2 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:mariadb:mariadb::::::::	10.6.1 to before 10.6.28; 10.11.1 to before 10.11.19; 11.4.1 to before 11.4.13; 11.8.1 to before 11.8.9; 12.3.1 to before 12.3.3; 13.0.1 to before 13.0.2	Vulnerable	MariaDB

cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:* Versions 10.6.1 to before 10.6.28; 10.11.1 to before 10.11.19; 11.4.1 to before 11.4.13; 11.8.1 to before 11.8.9; 12.3.1 to before 12.3.3; 13.0.1 to before 13.0.2 Vulnerable ·MariaDB

Remediation

Upgrade MariaDB server to 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3 or 13.0.2. Red Hat fixes Red Hat Hardened Images in RHSA-2026:83108 and RHSA-2026:84689. Red Hat Enterprise Linux 7, 8, 9 and 10 have no fix available, and Red Hat OpenStack Platform 13 (Queens) has no fix planned.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Fix · CNA server (MariaDB) Fixed in 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, 13.0.2

Red Hat 2 advisories

RHSA-2026:84689 Released 2026-10-19 · Red Hat rating Important
Red Hat Hardened Images RPMs bug fix and enhancement update
- Red Hat Hardened Images mariadb11.8-3:11.8.9-0.1.hum1@aarch64, mariadb11.8-3:11.8.9-0.1.hum1@s390x, mariadb11.8-3:11.8.9-0.1.hum1@src +47
RHSA-2026:83108 Released 2026-10-14 · Red Hat rating Important
Red Hat Hardened Images RPMs Security Update
- Red Hat Hardened Images mariadb10.11-10.11.18-4.1.hum1@aarch64, mariadb10.11-10.11.18-4.1.hum1@s390x, mariadb10.11-10.11.18-4.1.hum1@src +47

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Product	Status	Plan or fix
Red Hat Enterprise Linux 10	Affected	No fix yet: Fix deferred
Red Hat Enterprise Linux 7	Affected	No fix yet: Fix deferred
Red Hat Enterprise Linux 8	Affected	No fix yet: Fix deferred
Red Hat Enterprise Linux 9	Affected	No fix yet: Fix deferred
Red Hat OpenStack Platform 13 (Queens)	Affected	No fix planned: Out of support scope
Red Hat Hardened Images	Fixed	RHSA-2026:83108, RHSA-2026:84689

Timeline

2026-10-10 Threatist record created from CVE-2026-107816
2026-10-10 Affected versions changed · Red Hat
2026-10-10 CVSS score added · Red Hat
2026-10-11 Priority changed: MEDIUM → LOW
2026-10-13 CISA SSVC decision points changed
2026-10-16 Fix available: RHSA-2026:83108 · Red Hat
2026-10-16 Fix available: Red Hat Hardened Images · Red Hat
2026-10-20 Fix available: RHSA-2026:84689 · Red Hat
2026-10-20 Affected versions changed · Red Hat

References

Patch 1

https://github.com/MariaDB/server/commit/0931994096b84ecc9ffc8eb3517c7e09e6e8631e

Advisory 1

https://github.com/MariaDB/server/security/advisories/GHSA-wfqg-88r5-55f6

Other 7

TI-2023-11776 MariaDB v10.5 was discovered to contain a remote code execution (RCE) vulnerability via… CVSS 3.1CRITICAL 9.8
TI-2016-05707 Oracle MySQL through 5.5.52, 5.6.x through 5.6.33, and 5.7.x through 5.7.15; MariaDB… CVSS 3.0CRITICAL 9.8
TI-2022-00687 Infinite loop in BN_mod_sqrt() reachable when parsing certificates CVSS 3.1HIGH 7.5
TI-2014-00217 OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly… CVSS 3.1HIGH 7.4
TI-2014-00188 The dtls1_reassemble_fragment function in d1_both.c in OpenSSL before 0.9.8za, 1.0.0… CVSS 2.0MEDIUM 6.8
TI-2018-15259 zlib before 1.2.12 allows memory corruption when deflating (i.e., when compressing) if… CVSS 3.1HIGH 7.5

See all 429 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences