CVE-2026-32710: 
MariaDB Server vulnerability analysis and mitigation

CVE-2026-32710 is a heap-based buffer overflow vulnerability in the JSON_SCHEMA_VALID() function of MariaDB Server, allowing an authenticated attacker to crash the database or potentially achieve remote code execution. It affects MariaDB versions 11.4.1–11.4.9, 11.8.1–11.8.5, and 12.1.2. The vulnerability was published on March 20, 2026, and patches were released the same day. It carries a CVSS v3.1 base score of 9.9 (Critical) per NVD scoring, or 8.5 (High) per the MariaDB GitHub advisory (GitHub Advisory, Red Hat Bugzilla).

The root cause is a heap-based buffer overflow (CWE-122) and classic buffer overflow (CWE-120) in MariaDB's implementation of the JSON_SCHEMA_VALID() SQL function. An authenticated user can send a crafted SQL query invoking this function to trigger an out-of-bounds write on the heap, causing a server crash. Under tightly controlled memory layout conditions — generally only reproducible in a lab environment — the overflow could potentially be leveraged for remote code execution. The vulnerability was discovered by Team Xint Code as part of the zeroday.cloud research program, and a public PoC has since appeared on GitHub (GitHub Advisory, MariaDB JIRA).

Successful exploitation by an authenticated attacker results in a confirmed denial of service via server crash, disrupting database availability for all connected applications. Under specific memory layout conditions achievable in controlled environments, the vulnerability could escalate to remote code execution with the privileges of the MariaDB server process, potentially compromising confidentiality and integrity of all hosted data. The changed scope in the CVSS vector indicates that a successful RCE could impact resources beyond the database itself, enabling lateral movement within the hosting environment (GitHub Advisory, Red Hat Bugzilla).

A public proof-of-concept exploit has been published on GitHub (github.com/dinosn/CVE-2026-32710) and indexed by Sploitus and Vulners, indicating active weaponization interest from the security community (Sploitus, Vulners). As of the time of reporting, there is no confirmed evidence of in-the-wild exploitation or threat actor attribution. The EPSS score is approximately 0.0029 (0.29%), reflecting a currently low but non-negligible probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Detection plugins are available from Nessus (IDs: 303254, 306707, 315423, 315477) and Qualys.

1. Reconnaissance: Identify internet-facing or network-accessible MariaDB instances running versions 11.4.1–11.4.9, 11.8.1–11.8.5, or 12.1.2 using network scanners or service fingerprinting tools (e.g., Nmap with MySQL/MariaDB probes).
2. Obtain credentials: Acquire valid low-privilege database credentials through phishing, credential stuffing, or exploitation of another vulnerability — only LOW privileges are required.
3. Connect to the database: Establish a connection to the MariaDB server using a standard MySQL client or scripted connector.
4. Trigger the overflow: Execute a crafted SQL query invoking JSON_SCHEMA_VALID() with a malformed or oversized input designed to overflow the heap buffer, e.g., SELECT JSON_SCHEMA_VALID('<malformed_schema>', '<payload>');.
5. Achieve DoS or RCE: The crafted input causes an out-of-bounds heap write, crashing the MariaDB server process (DoS). In a controlled environment with precise heap grooming, the overflow can be directed to overwrite function pointers or return addresses to achieve code execution as the MariaDB service account (GitHub Advisory, MariaDB JIRA).

• Network: Unusual or repeated authenticated connections to MariaDB from unexpected source IPs; high-frequency SQL queries targeting JSON_SCHEMA_VALID() from a single client.
• Logs: MariaDB error log (/var/log/mysql/error.log or equivalent) showing unexpected server crashes, segmentation faults, or heap corruption messages; entries referencing JSON_SCHEMA_VALID immediately before crash events.
• Process: Unexpected termination and restart of the mysqld or mariadbd process; child processes spawned by the database service (indicative of RCE).
• File System: New or modified files in the MariaDB data directory or system directories created by the database service account; unexpected cron jobs or startup scripts added under the mysql user context.

Upgrade to a patched version immediately: MariaDB 11.4.10 (for 11.4.x users), MariaDB 11.8.6 (for 11.8.x users), or MariaDB 12.2.2 (for 12.1.2 users) (GitHub Advisory). Red Hat Enterprise Linux users should apply RHSA-2026:19021 (RHEL 10) or RHSA-2026:19182 (RHEL 9), and openSUSE users should apply the relevant security announcements (Red Hat Bugzilla). As interim mitigations, restrict database access to trusted users only, implement network segmentation to limit MariaDB exposure, and monitor for anomalous JSON_SCHEMA_VALID() function calls in query logs.

The vulnerability received coverage from Heise Online, describing it as enabling "malicious code or crashes" in MariaDB databases, and from CSO Online and InfoWorld, which highlighted it alongside a related PostgreSQL finding as AI-discovered 20-year-old bugs (Heise Online, CSO Online). The zeroday.cloud team published a technical deep-dive blog post on the vulnerability (zeroday.cloud). The Hacker News weekly recap included the vulnerability in its roundup, and social media discussion appeared on Mastodon and Bluesky, indicating moderate community awareness. The PoC publication by researcher @dinosn on GitHub generated additional attention from the security community.