CVE-2026-107817: 
MariaDB Server Análisis y mitigación de vulnerabilidades

CVE-2026-107817 is an out-of-bounds read vulnerability in the mysql_json plugin of MariaDB Server, a community-developed fork of MySQL. The plugin incorrectly assumes that imported MySQL tables contain valid MySQL binary JSON data; a specially crafted table with invalid JSON data can trigger out-of-bounds reads, information disclosure, or a server crash. Affected versions span multiple branches: 10.6.1–10.6.27, 10.11.1–10.11.18, 11.4.1–11.4.12, 11.8.1–11.8.8, 12.3.1–12.3.2, and 13.0.1. The vulnerability was reported by Yuelin Wang, disclosed via GitHub Security Advisory on September 7, 2026, and published to NVD on October 9, 2026. It carries a CVSS v3.1 base score of 4.4 (Medium) (GitHub Advisory, Red Hat CVE).

The root cause is classified as CWE-125 (Out-of-bounds Read). The mysql_json plugin's parser functions — specifically parse_mysql_scalar_or_value and parse_array_or_object in plugin/type_mysql_json/mysql_json.cc — failed to validate that computed offsets and lengths remained within the bounds of the input buffer before reading data. An attacker with local filesystem access can place a specially crafted .MYD data file (containing malformed MySQL binary JSON) into the MariaDB data directory, then trigger processing via an ALTER TABLE ... FORCE or similar operation that invokes the plugin. The fix adds boundary checks (e.g., value_start >= len and key_start + key_len > bytes) before dereferencing offsets (GitHub Commit, GitHub Advisory).

Successful exploitation can result in out-of-bounds memory reads that disclose sensitive in-memory data (low confidentiality impact) or cause the MariaDB server process to crash, resulting in a denial of service (low availability impact). There is no integrity impact, and the scope is unchanged, meaning exploitation is confined to the MariaDB server process itself. Because the attack vector is local and requires user interaction (e.g., importing a malicious table file), the risk of broad lateral movement is limited, though information disclosed from server memory could potentially expose credentials or query data (GitHub Advisory, Red Hat CVE).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation at this time (Feedly). The EPSS score is 0.0, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires local access to the server's data directory and user interaction to trigger table processing, significantly limiting the attack surface.

1. Gain local access: Obtain local filesystem access to the MariaDB server's data directory (e.g., via a compromised OS account or misconfigured file permissions).
2. Prepare malicious table files: Create or obtain a set of MariaDB/MySQL table files (.frm, .MYI, .MYD) where the .MYD data file contains malformed MySQL binary JSON — for example, by copying a valid table's files and then patching specific byte offsets in the .MYD file to introduce invalid JSON structure (as demonstrated in the test case at offset 0x3c5 or 0x3bc).
3. Place files in data directory: Copy the crafted .frm, .MYI, and .MYD files into the target database's data directory (e.g., /var/lib/mysql/test/t1.*).
4. Trigger plugin processing: Execute a MariaDB statement that forces the mysql_json plugin to parse the table data, such as ALTER TABLE t1 FORCE;, which invokes the plugin's JSON parsing routines on the malformed data.
5. Observe outcome: The server either crashes (denial of service) or reads out-of-bounds memory, potentially disclosing sensitive data from the server process's memory space (GitHub Commit, GitHub Advisory).

• File System: Unexpected or newly created .frm, .MYI, or .MYD files in the MariaDB data directory that do not correspond to known tables; file modification timestamps on existing .MYD files that do not align with normal database activity.
• Logs: MariaDB error log entries containing Error parsing MySQL JSON format, please dump this table from MySQL and then restore it to be able to use it in MariaDB; unexpected ER_UNKNOWN_ERROR entries associated with ALTER TABLE ... FORCE operations.
• Process: Unexpected MariaDB server crashes or restarts (check OS-level crash logs or mysqld core dumps); abnormal memory access violations in the MariaDB process.

Upgrade MariaDB Server to a patched version: 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, or 13.0.2, depending on the active version branch (GitHub Advisory). As a workaround, do not install the mysql_json plugin unless actively needed for MySQL-to-MariaDB migration; uninstall it immediately after migration is complete. Additionally, ensure the FILE privilege is restricted and secure-file-priv is configured to prevent unauthorized writes into the data directory, and restrict local filesystem permissions so that unprivileged users cannot create or modify files in the data directory (GitHub Advisory).