CVE-2026-107821: MariaDB Server RCE Vulnerability

CVE-2026-107821 is a remote code execution vulnerability in MariaDB Server caused by insufficient validation of FRM metadata. Attackers with file placement access could crash the server or execute code. This article covers technical details, affected versions, impact assessment, and mitigation strategies.

CVE-2026-107821 Overview

CVE-2026-107821 is a memory safety vulnerability in MariaDB server affecting versions from 10.6.1 through multiple release branches. The flaw stems from insufficient validation of counts, offsets, lengths, and field boundaries in FRM metadata when the server opens binary FRM files. An attacker who can place a crafted FRM file in the data directory can trigger out-of-bounds reads or writes. Successful exploitation can crash the server or potentially lead to code execution within the database process. MariaDB has released fixed builds across all supported branches.

Critical Impact
An attacker with write access to the MariaDB data directory can corrupt memory in the database server process, causing denial of service or potentially achieving code execution.

Affected Products

MariaDB server versions 10.6.1 through 10.6.27
MariaDB server versions 10.11.0 through 10.11.18, 11.4.0 through 11.4.12, and 11.8.0 through 11.8.8
MariaDB server versions 12.3.0 through 12.3.2 and 13.0.0 through 13.0.1

Discovery Timeline

2026-10-09 - CVE CVE-2026-107821 published to NVD
2026-10-14 - Last updated in NVD database

Technical Details for CVE-2026-107821

Vulnerability Analysis

The vulnerability resides in the FRM file parsing routines of MariaDB. FRM files store table metadata such as column definitions, key information, and record layouts. When the server opens a table, it reads the associated binary FRM file and uses embedded length and offset fields to locate structures in memory.

MariaDB does not sufficiently validate these counts, offsets, lengths, and field boundaries against the actual file size or allocated buffer size. A crafted FRM file can therefore steer the parser into reading or writing memory outside the intended buffer. This condition is tracked under CWE-1285 (Improper Validation of Specified Index, Position, or Offset in Input).

Root Cause

The root cause is missing bounds checks on metadata fields during FRM deserialization. Parser code trusts length and offset values provided inside the FRM blob and uses them directly in pointer arithmetic and copy operations. Specific commit details are available in the MariaDB upstream fix and tracked in MDEV-40571.

Attack Vector

Exploitation requires the attacker to place a malicious FRM file inside the server data directory and trigger table open operations. This typically assumes high-privileged filesystem access, local user access to the DB host, or a chained vulnerability that allows arbitrary file writes to the data directory. Once the server opens the crafted table, the parser dereferences attacker-controlled offsets, producing out-of-bounds memory access within the mysqld/mariadbd process address space.

Technical details are described in the MariaDB Security Advisory GHSA-c4gx-34mg-95q5.

Detection Methods for CVE-2026-107821

Indicators of Compromise

Unexpected .frm files appearing in the MariaDB datadir whose creation did not come from a CREATE TABLE statement.
Unexplained mysqld/mariadbd crashes, segmentation faults, or ASAN reports when opening specific tables.
Audit log entries showing OPEN TABLE operations immediately preceding a server restart or crash.

Detection Strategies

Monitor filesystem integrity on the MariaDB data directory and alert on .frm writes performed by processes other than mysqld/mariadbd.
Correlate database error logs with operating system crash telemetry to identify repeated faults originating in FRM parsing code paths.
Review access controls and audit which non-DB processes or users have write permission to the data directory.

Monitoring Recommendations

Enable the MariaDB audit plugin and ship logs to a centralized SIEM for correlation with host telemetry.
Alert on new or modified .frm files that lack a corresponding DDL statement in the server logs.
Track process crashes of mariadbd and tie them to the last table-open operation.

How to Mitigate CVE-2026-107821

Immediate Actions Required

Upgrade MariaDB to a fixed build: 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, or 13.0.2.
Restrict write access to the MariaDB data directory to the database service account only.
Audit the data directory for any .frm files that were not created through supported DDL operations.

Patch Information

Fixed releases are available on the MariaDB GitHub project: 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2. The upstream fix is referenced in commit 3b1c2e58.

Workarounds

Enforce strict filesystem permissions (0700) on the datadir and run mysqld/mariadbd under a dedicated unprivileged user.
Isolate the database host so that only the DB service and administrators can write to the data directory, and disable shell access for application users.
Deploy mandatory access control profiles (SELinux or AppArmor) that confine the MariaDB process to its intended paths.

bash

# Configuration example - restrict data directory permissions
sudo chown -R mysql:mysql /var/lib/mysql
sudo chmod 700 /var/lib/mysql
sudo find /var/lib/mysql -type f -name '*.frm' -exec chmod 660 {} \;

# Verify the installed MariaDB version is patched
mariadbd --version