CVE-2026-107817: MariaDB Information Disclosure Vulnerability

CVE-2026-107817 Overview

CVE-2026-107817 affects the MariaDB server mysql_json plugin, which handles imported MySQL binary JSON data. The plugin assumed all imported MySQL tables contained valid binary JSON structures without validating offsets against buffer length. A specially crafted MySQL table containing invalid JSON data can trigger out-of-bounds reads during parsing. The flaw is tracked as [CWE-125] (Out-of-Bounds Read) and impacts MariaDB versions from 10.6.1 up to the fixed releases. Exploitation can cause information disclosure or a server crash when a user imports or queries a malicious MySQL table.

Critical Impact

A local user able to supply a crafted MySQL-format table can trigger out-of-bounds memory reads in mysql_json, leading to information disclosure or MariaDB server crash.

Affected Products

• MariaDB server 10.6.1 through 10.6.27
• MariaDB server 10.11 through 10.11.18, 11.4 through 11.4.12, 11.8 through 11.8.8
• MariaDB server 12.3 through 12.3.2 and 13.0 through 13.0.1

Discovery Timeline

• 2026-10-09 - CVE-2026-107817 published to NVD
• 2026-10-14 - Last updated in NVD database

Technical Details for CVE-2026-107817

Vulnerability Analysis

The mysql_json plugin provides compatibility for reading MySQL-formatted binary JSON columns inside MariaDB. The plugin parses a binary layout composed of a value type byte followed by inline or offset-referenced value data. The parser trusts offsets embedded in the input and dereferences them without verifying they remain within the buffer boundary. A malformed table crafted outside MariaDB and attached via .frm/.ibd import can therefore drive the parser past the end of the allocated buffer during scalar extraction. The resulting read returns adjacent heap memory to the caller or dereferences unmapped memory and crashes the server process.

Root Cause

In plugin/type_mysql_json/mysql_json.cc, the function handling inline scalar extraction computes value_start = value_type_offset + 1 and then calls parse_mysql_scalar with data + value_start and len - value_start. When value_start is greater than or equal to len, the subtraction underflows and the parser reads memory outside the JSON blob.

Attack Vector

The attack vector is local and requires user interaction. An attacker supplies or convinces an administrator to attach a MySQL-format table containing a malformed JSON column. Any subsequent SELECT touching that column triggers the vulnerable code path in the mysql_json plugin.

   if (type_is_stored_inline(value_type, large))
   {
     const size_t value_start = value_type_offset + 1;
-    if (parse_mysql_scalar(buffer, value_type, data + value_start,
+    if (value_start >= len ||
+        parse_mysql_scalar(buffer, value_type, data + value_start,
                            len - value_start))
       return true;
   }

Source: MariaDB commit 851f5247 — the patch adds a bounds check (value_start >= len) before invoking parse_mysql_scalar, preventing the out-of-bounds read.

Detection Methods for CVE-2026-107817

Indicators of Compromise

• Unexpected mariadbd/mysqld process crashes with SIGSEGV while queries reference columns of type JSON imported from MySQL.
• Error log entries referencing mysql_json plugin, parse_mysql_scalar, or signal 11 stack traces.
• Imports of MySQL-origin .frm and tablespace files from untrusted sources immediately preceding the above events.

Detection Strategies

• Inventory MariaDB instances and flag any running affected versions below the fixed releases listed in the MariaDB advisory GHSA-89ph-64cf-gqcc.
• Audit tables where the storage engine metadata indicates MySQL-origin JSON columns parsed by mysql_json rather than MariaDB native JSON/LONGTEXT.
• Correlate database crash telemetry with recent ALTER TABLE, IMPORT TABLESPACE, or restore operations.

Monitoring Recommendations

• Forward MariaDB error logs and audit plugin output to a central log platform for query and crash correlation.
• Alert on repeated mariadbd restarts, segmentation faults, or mysql_json-tagged plugin errors within short windows.
• Monitor filesystem writes into MariaDB data directories by non-database processes that could stage malicious table files.

How to Mitigate CVE-2026-107817

Immediate Actions Required

• Upgrade MariaDB to 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, or 13.0.2 depending on the deployed branch.
• Restrict FILE, SUPER, and tablespace import privileges to trusted administrators only.
• Reject import of MySQL-origin table files from untrusted sources until systems are patched.

Patch Information

MariaDB fixed the issue in commit 851f5247 by adding a bounds check before parse_mysql_scalar. Fixed releases are available at MariaDB 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2. Tracking issue: MDEV-40678.

Workarounds

• Uninstall the mysql_json plugin if MySQL binary JSON compatibility is not required.
• Convert MySQL-imported JSON columns to MariaDB-native LONGTEXT/JSON storage after validation to avoid the vulnerable parser path.
• Isolate database instances that must process untrusted MySQL imports behind restricted service accounts and resource limits.

# Disable the mysql_json plugin at runtime (requires restart to persist)
mariadb -u root -p -e "UNINSTALL SONAME 'type_mysql_json';"

# Prevent the plugin from loading at startup
# Add to /etc/mysql/mariadb.conf.d/50-server.cnf under [mariadbd]:
#   disable_mysql_json=1