CVE-2026-107815: MariaDB CONNECT Engine RCE Vulnerability

CVE-2026-107815 Overview

CVE-2026-107815 is an out-of-bounds write vulnerability [CWE-787] in the MariaDB server CONNECT storage engine. The flaw resides in the DOS table type, which uses an incorrect boundary check when processing numeric column values. An authenticated user with permission to use the CONNECT engine can trigger a one-byte null write beyond a stack buffer at an attacker-controlled offset. The condition can crash the server and potentially enable remote code execution. MariaDB versions from 10.6.1 through the fixed releases are affected.

Critical Impact
An authenticated attacker with access to the CONNECT engine can corrupt stack memory, crash the database service, and potentially achieve remote code execution on the host.

Affected Products

MariaDB server 10.6.1 through 10.6.27
MariaDB server 10.11.0 through 10.11.18, and 11.4.0 through 11.4.12
MariaDB server 11.8.0 through 11.8.8, 12.3.0 through 12.3.2, and 13.0.0 through 13.0.1

Discovery Timeline

2026-10-09 - CVE-2026-107815 published to NVD
2026-10-14 - Last updated in NVD database

Technical Details for CVE-2026-107815

Vulnerability Analysis

The vulnerability lives in the CONNECT storage engine's DOS table type, which parses fixed and variable-width text records. When converting an input field to a numeric value, the code copies up to n bytes into a 32-byte stack buffer buf[32] and then writes a terminating null at buf[n]. The upstream code applied MY_MIN(n, 31) only to the memcpy length while leaving n unchanged, so the subsequent buf[n] = '\0' wrote one null byte at an offset derived from attacker-supplied data.

Because n is driven by the column definition and record contents, an authenticated user who can create or query a CONNECT DOS table controls the offset of the one-byte write. Overwriting adjacent stack metadata, including saved registers or return addresses, is sufficient to cause a crash and may be leveraged for code execution under the mariadbd process.

Root Cause

The root cause is an off-by-many boundary check in storage/connect/value.cpp. The memcpy length was bounded, but the surrounding variable used to compute the null-terminator index was not, producing a classic out-of-bounds write primitive tracked internally as MDEV-40637.

Attack Vector

Exploitation requires network access to the MariaDB server and authenticated credentials with privileges to use the CONNECT engine and define a DOS table. No user interaction is required. The scope is marked as changed because the compromise occurs in a privileged database process that may host multiple tenants or databases.

cpp

// Patch in storage/connect/value.cpp (MDEV-40637)
     for (; n > 0 && *p == ' '; p++)
       n--;
 
-    memcpy(buf, p, MY_MIN(n, 31));
+    memcpy(buf, p, n= MY_MIN(n, 31));
     buf[n] = '\0';
     Tval = atof(buf);

Source: MariaDB commit b369925f. The fix assigns the clamped MY_MIN(n, 31) result back into n, so the subsequent buf[n] write stays inside the 32-byte buffer.

Detection Methods for CVE-2026-107815

Indicators of Compromise

Unexpected mariadbd segmentation faults or core dumps correlated with queries against CONNECT DOS tables.
Creation of new ENGINE=CONNECT tables with TABLE_TYPE=DOS by non-administrative accounts.
Database error log entries referencing value.cpp, atof, or stack corruption near CONNECT code paths.

Detection Strategies

Audit information_schema.TABLES for tables with ENGINE='CONNECT' and flag any DOS table types created outside approved change windows.
Enable the MariaDB audit plugin and alert on CREATE TABLE statements that reference the CONNECT engine from unexpected users or hosts.
Monitor process supervisors (systemd, Kubernetes) for repeated mariadbd restarts, which can indicate crash-based probing of the flaw.

Monitoring Recommendations

Centralize MariaDB error logs and audit logs into your SIEM and correlate crashes with the originating session user and query text.
Baseline which service accounts legitimately use the CONNECT engine, and alert on first-time usage by any other principal.
Watch host-level telemetry for child processes or shells spawned by mariadbd, which would be anomalous and consistent with post-exploitation.

How to Mitigate CVE-2026-107815

Immediate Actions Required

Upgrade MariaDB server to 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, or 13.0.2 as appropriate for your release branch.
Revoke the CONNECT engine privilege from any account that does not explicitly require it, and review existing CONNECT tables.
Restrict network reachability of the MariaDB port to trusted application tiers only.

Patch Information

The fix is published in the MariaDB Security Advisory GHSA-4wgx-ffg9-jrwq and implemented in commit b369925f. Fixed binaries are available in the 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2 releases. Issue tracking is available at MDEV-40637.

Workarounds

Disable the CONNECT storage engine entirely if it is not required: set --disable-connect or omit the ha_connect.so plugin at startup.
Drop existing CONNECT DOS tables and prevent their recreation through least-privilege account configuration.
Isolate MariaDB instances exposing the CONNECT engine behind strict network ACLs until patching completes.

bash

# Disable the CONNECT plugin until patching is complete
mysql -u root -p -e "UNINSTALL SONAME 'ha_connect';"

# Or prevent load at startup via my.cnf
# [mariadbd]
# plugin-load-add=
# disable-connect