CVE-2026-44172: 
MariaDB Server vulnerability analysis and mitigation

CVE-2026-44172 is a SQL injection vulnerability in the MariaDB Connector/C library (libmariadb) where mysql_real_escape_string() fails to correctly handle the big5 character set, allowing attackers to bypass the escaping function and inject arbitrary SQL commands. It affects libmariadb versions 3.3.18 and 3.4.8, and was discovered by Jun Rong at Calif.io, published on May 18, 2026, with patches released in versions 3.3.19 and 3.4.9 (GitHub Advisory). The vulnerability carries a CVSS v3.1 base score of 9.8 (Critical) and a CVSS v4.0 base score of 6.9 (Medium) (GitHub Advisory).

The root cause is classified as CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), specifically in how libmariadb's mysql_real_escape_string() processes multi-byte characters in the big5 encoding. The big5 character set uses two-byte sequences where the second byte can coincide with ASCII special characters (e.g., backslash \x5c), causing the escape function to misinterpret the byte stream and leave SQL metacharacters unescaped. Exploitation requires an application that: (1) accepts non-validated user input, (2) escapes it with mysql_real_escape_string(), (3) uses the text protocol (not prepared statements), and (4) connects to the database with the big5 character set configured (GitHub Advisory). The vulnerability is tracked in MariaDB's issue tracker as CONC-819 (GitHub Advisory).

An unauthenticated remote attacker who can supply input to a vulnerable application can inject arbitrary SQL commands, enabling unauthorized reading of sensitive database contents, modification or deletion of data, and potentially operating system command execution if the database account has elevated privileges such as FILE or SUPER (GitHub Advisory). The confidentiality, integrity, and availability impacts are all rated High under CVSS v3.1, reflecting the potential for full database compromise and lateral movement depending on the deployment context.

1. Reconnaissance: Identify web applications or services that use MariaDB Connector/C (libmariadb) versions 3.3.18 or 3.4.8 and accept user-supplied input in database queries.
2. Confirm big5 character set usage: Probe the application for responses or error messages indicating big5 encoding is in use for the database connection (e.g., via HTTP response headers, error messages, or application source code review).
3. Craft a big5-encoded payload: Construct input containing a big5 multi-byte sequence whose second byte is 0x5c (backslash). When mysql_real_escape_string() processes this, it misinterprets the byte boundary and fails to escape the trailing SQL metacharacter (e.g., a single quote '), leaving it unescaped in the final query.
4. Inject SQL: Submit the crafted input through the vulnerable application parameter (e.g., a login form, search field, or API endpoint). The unescaped quote or other metacharacter breaks out of the intended SQL string context.
5. Execute arbitrary SQL: Append malicious SQL clauses (e.g., UNION SELECT, OR 1=1, ; DROP TABLE) to extract data, modify records, or escalate privileges depending on the database user's permissions (GitHub Advisory).

• Logs: Database query logs showing unexpected SQL syntax such as UNION SELECT, OR 1=1, stacked queries (;), or comment sequences (--, #) originating from application-layer parameters; application error logs showing SQL syntax errors from user-supplied fields.
• Network: Unusual or large volumes of database query responses to a single client IP; unexpected outbound connections from the database server if OS-level commands are executed via SQL (INTO OUTFILE, LOAD_FILE, xp_cmdshell equivalents).
• File System: Unexpected files written to web-accessible directories via SQL INTO OUTFILE statements; new or modified files in the MariaDB data directory.
• Process: Unexpected child processes spawned by the MariaDB server process (e.g., shell commands executed via UDF or sys_exec) (GitHub Advisory).

Upgrade libmariadb (MariaDB Connector/C) to version 3.3.19 or 3.4.9, which contain the fix for this vulnerability (GitHub Advisory). If immediate patching is not possible, two workarounds are available: (1) switch the database connection character set from big5 to gbk or another unaffected encoding, or (2) refactor application code to use parameterized queries (prepared statements) instead of string escaping with mysql_real_escape_string(). SUSE has also released security updates addressing this vulnerability for affected Linux distributions (SUSE Advisory).

SUSE issued security update announcements (SUSE-SU-2026:2282-1 and SUSE-SU-2026:2330-1) addressing this vulnerability for their enterprise Linux distributions (SUSE Advisory). The vulnerability has been picked up by Linux security news outlets and vulnerability aggregators including Tenable (Nessus plugins 319629 and 321069), Alpine Linux, Debian, and openSUSE security channels. The advisory credits Jun Rong at Calif.io as the discoverer (GitHub Advisory).