CVE-2026-107821

Status: AnalyzedHigh (8)—PoC

Severity8High · CVSS 3.1

Exploitation probability0.76 %higher than 54% of CVEs

Active exploitationNonot in the CISA catalog

Public exploitAvailableProof of concept on GitHub (unverified)

MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB insufficiently validated counts, offsets, lengths, and field boundaries in FRM metadata while opening binary FRM files. An attacker able to place a crafted FRM file in the data directory could trigger out-of-bounds reads or writes, crash the server, or potentially execute code. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.

CVSS

Base score: 8
Version: 3.1
Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

Exploitation probability (EPSS)

Probability of exploitation in the next 30 days: 0.76 %
Percentile among all scored CVEs: 54
Score date: 10/20/2026

EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).

Public exploits

Exploit code or detection templates are publicly available. This is not the same as confirmed active exploitation (KEV), but it raises the risk: patch with priority.

Proof of concept on GitHub (unverified) · List of proofs of concept on GitHub

⚠️ GitHub proofs of concept are not verified: some are fake or contain malware. Never run them outside an isolated lab.

ATT&CK techniques

How this vulnerability is exploited and what the attacker gains, in MITRE ATT&CK terms.

ExploitationT1210 Exploitation of Remote Serviceslateral movement70 %
Primary impactT1499.004 Application or System Exploitationimpact75 %
Secondary impactT1005 Data from Local Systemcollection55 %
Secondary impactT1059 Command and Scripting Interpreterexecution60 %

Vector CVSS con AV:N, PR:H (privilegios altos requeridos) indica explotación de servicio remoto (T1210). Colocación de archivo FRM malformado causa lecturas fuera de límites, crashes (DoS de aplicación T1499.004) o ejecución de código potencial (T1059). Acceso a datos y escritura OOB también posible

Inferred by our analysis agent from the official description, CVSS vector and CWE, and checked by a supervisor. May contain errors.

ATT&CK mitigations that cover these techniques

Privileged Account Management Disable or Remove Feature or Program Vulnerability Scanning Threat Intelligence Program Restrict Web-Based Content Network Segmentation

Affected technologies (1)

Mariadb — Mariadb

CWEs

CWE-1285

References

Show 9 references

Raw JSON (NVD)

Show

{
  "id": "CVE-2026-107821",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-107821",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-10-09T17:42:08.587821Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 8,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "HIGH",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "HIGH",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 6,
        "exploitabilityScore": 1.3
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "MariaDB",
          "product": "server",
          "versions": [
            {
              "status": "affected",
              "version": ">= 10.6.1, < 10.6.28"
            },
            {
              "status": "affected",
              "version": ">= 10.11.1, < 10.11.19"
            },
            {
              "status": "affected",
              "version": ">= 11.4.1, < 11.4.13"
            },
            {
              "status": "affected",
              "version": ">= 11.8.1, < 11.8.9"
            },
            {
              "status": "affected",
              "version": ">= 12.3.1, < 12.3.3"
            },
            {
              "status": "affected",
              "version": ">= 13.0.1, < 13.0.2"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-10-09T18:17:03.860",
  "references": [
    {
      "url": "https://github.com/MariaDB/server/commit/3b1c2e58abab5571bec4ff52773ddc75b1738da9",
      "tags": [
        "Patch"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19",
      "tags": [
        "Release Notes"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28",
      "tags": [
        "Release Notes"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13",
      "tags": [
        "Release Notes"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9",
      "tags": [
        "Release Notes"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3",
      "tags": [
        "Release Notes"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2",
      "tags": [
        "Release Notes"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/MariaDB/server/security/advisories/GHSA-c4gx-34mg-95q5",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://jira.mariadb.org/browse/MDEV-40571",
      "tags": [
        "Issue Tracking"
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-1285"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB insufficiently validated counts, offsets, lengths, and field boundaries in FRM metadata while opening binary FRM files. An attacker able to place a crafted FRM file in the data directory could trigger out-of-bounds reads or writes, crash the server, or potentially execute code. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2."
    }
  ],
  "lastModified": "2026-10-14T14:13:07.733",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6A6667AA-6A82-49E2-894B-318569872468",
              "versionEndExcluding": "10.6.28",
              "versionStartIncluding": "10.6.1"
            },
            {
              "criteria": "cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C18A44B6-CEEF-47D7-9D60-04E6EBAFC785",
              "versionEndExcluding": "10.11.19",
              "versionStartIncluding": "10.11.1"
            },
            {
              "criteria": "cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "47070DA5-F754-4FE1-957A-375C39D9029E",
              "versionEndExcluding": "11.4.13",
              "versionStartIncluding": "11.4.1"
            },
            {
              "criteria": "cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "39AD11EC-57BE-4D2B-9A7C-E667E23A6940",
              "versionEndExcluding": "11.8.9",
              "versionStartIncluding": "11.8.1"
            },
            {
              "criteria": "cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E6988F1C-2D11-431B-BBE4-3AA8483627C8",
              "versionEndExcluding": "12.3.3",
              "versionStartIncluding": "12.3.1"
            },
            {
              "criteria": "cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B427DCA2-1080-4276-9C4C-D90BA53DDDBF",
              "versionEndExcluding": "13.0.2",
              "versionStartIncluding": "13.0.1"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security-advisories@github.com"
}