CVE-2026-107816: MariaDB Server Buffer Overflow Vulnerability

CVE-2026-107816 Overview

CVE-2026-107816 is an out-of-bounds read vulnerability [CWE-125] in the MariaDB server qc_info plugin. The flaw affects MariaDB versions from 10.6.1 up to the patched releases 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2. A query containing embedded null bytes can confuse the plugin's parsing logic. When an authenticated user subsequently reads information_schema.query_cache_info, the server accesses memory beyond a heap-allocated buffer. This can disclose adjacent memory contents or crash the database process.

Critical Impact
An authenticated attacker can trigger a heap out-of-bounds read in the MariaDB server, resulting in memory disclosure or a server crash affecting database availability.

Affected Products

MariaDB server 10.6.1 through 10.6.27
MariaDB server 10.11.x prior to 10.11.19, 11.4.x prior to 11.4.13, and 11.8.x prior to 11.8.9
MariaDB server 12.3.x prior to 12.3.3 and 13.0.x prior to 13.0.2

Discovery Timeline

2026-10-09 - CVE-2026-107816 published to NVD
2026-10-14 - Last updated in NVD database

Technical Details for CVE-2026-107816

Vulnerability Analysis

The vulnerability resides in the qc_info plugin, which exposes query cache metadata through the information_schema.query_cache_info virtual table. When MariaDB caches a query, the plugin parses a composite key structure that stores the statement text, a schema (database) name, and associated flags. The plugin reads the database name length from a two-byte field and uses it to retrieve the schema string from the cached entry.

If the original query contains embedded null bytes (\0), the plugin's assumptions about key layout break down. The stored db_length value can exceed the actual bytes remaining in the key buffer. When the plugin passes the oversized length to Field::store, the server reads past the end of the heap allocation. The EPSS score for this issue is 0.312%.

Root Cause

The root cause is missing bounds validation in plugin/qc_info/qc_info.cc. The code trusted the embedded db_length value without verifying it against the remaining key buffer size. Null bytes injected into the statement text alter length calculations downstream, producing an inconsistent key layout that bypasses the plugin's implicit size assumptions.

Attack Vector

Exploitation requires network access to the MariaDB server and valid credentials with privileges to execute queries and read information_schema. The attacker submits a crafted query containing embedded null bytes, waits for it to be cached, then selects from information_schema.query_cache_info to trigger the out-of-bounds read. The query cache must be enabled for the vulnerability to be reachable.

text

     compile_time_assert(QUERY_CACHE_DB_LENGTH_SIZE == 2); 
     db= key + statement_text_length + 1 + QUERY_CACHE_DB_LENGTH_SIZE;
     db_length= uint2korr(db - QUERY_CACHE_DB_LENGTH_SIZE);
+    set_if_smaller(db_length, (size_t)(key + key_length - QUERY_CACHE_FLAGS_SIZE - db));
 
     table->field[COLUMN_STATEMENT_SCHEMA]->store(db, db_length, scs);

Source: MariaDB server commit 0931994096b8. The patch clamps db_length so it cannot extend beyond the valid bytes remaining in the key buffer, preventing the out-of-bounds read.

Detection Methods for CVE-2026-107816

Indicators of Compromise

Unexpected mysqld or mariadbd process crashes or restarts correlated with SELECT statements against information_schema.query_cache_info.
Query logs showing statements that contain embedded null bytes followed by reads of the query cache info table.
Repeated connection failures or server restarts from accounts with low database privileges.

Detection Strategies

Review MariaDB general query logs and audit plugin output for queries containing \0 byte sequences, particularly from non-administrative accounts.
Monitor the server error log for signals of memory faults, assertion failures, or signal 11 (SIGSEGV) events tied to the query cache subsystem.
Correlate access patterns on information_schema.query_cache_info with preceding anomalous query content.

Monitoring Recommendations

Alert on crashes of the MariaDB service and on any non-admin role querying information_schema.query_cache_info.
Track MariaDB version inventory and flag hosts running pre-patch 10.6.x, 10.11.x, 11.4.x, 11.8.x, 12.3.x, or 13.0.x releases.
Capture database audit events to a central log store for retrospective hunting on null-byte query patterns.

How to Mitigate CVE-2026-107816

Immediate Actions Required

Upgrade MariaDB to version 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, or 13.0.2 depending on the installed release branch.
Audit database accounts and remove unnecessary query execution rights from service and application users.
Restrict network exposure of MariaDB listeners to trusted application subnets only.

Patch Information

The fix is delivered in the MariaDB releases listed in GHSA-wfqg-88r5-55f6 and tracked as MDEV-40670. The upstream commit is published at the MariaDB server commit log. Release artifacts are available for 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.

Workarounds

Disable the query cache by setting query_cache_type=OFF and query_cache_size=0 until patches can be applied.
Unload or disable the qc_info plugin so that information_schema.query_cache_info is unavailable to clients.
Revoke access to information_schema.query_cache_info from untrusted roles where feasible.

bash

# Disable the query cache in my.cnf and restart MariaDB
[mysqld]
query_cache_type=0
query_cache_size=0

# Or disable at runtime
mysql -u root -p -e "SET GLOBAL query_cache_size=0; SET GLOBAL query_cache_type=OFF;"

# Uninstall the qc_info plugin
mysql -u root -p -e "UNINSTALL PLUGIN query_cache_info;"