CVE-2026-32710

9.9 criticalEPSS 0.9%

Critical (9.9) in mariadb mariadb. EPSS 0.9% chance of exploitation in the next 30 days.

MariaDB server is a community developed fork of MySQL server. An authenticated user can crash MariaDB versions 11.4 before 11.4.10 and 11.8 before 11.8.6 via a bug in JSON_SCHEMA_VALID() function. Under certain conditions it might be possible to turn the crash into a remote code execution. These conditions require tight control over memory layout which is generally only attainable in a lab environment. This issue is fixed in MariaDB 11.4.10, MariaDB 11.8.6, and MariaDB 12.2.2.

Severity

CVSS 3.1

9.9 critical

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

EPSS: 0.9% chance of exploitation in the next 30 days; higher than 58% of CVEs (scores of 2026-10-31)
CWE: CWE-122
Published: 2026-03-20
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

mariadb:mariadb

References

https://github.com/MariaDB/server/security/advisories/GHSA-4rj5-2227-9wgc
https://jira.mariadb.org/browse/MDEV-38356

Check your stack JSON