CVE-2026-32710CRITICAL 9.9EPSS p53.6%

CVE-2026-32710CVE-2026-32710

Description

MariaDB server is a community developed fork of MySQL server. An authenticated user can crash MariaDB versions 11.4 before 11.4.10 and 11.8 before 11.8.6 via a bug in JSON_SCHEMA_VALID() function. Under certain conditions it might be possible to turn the crash into a remote code execution. These conditions require tight control over memory layout which is generally only attainable in a lab environment. This issue is fixed in MariaDB 11.4.10, MariaDB 11.8.6, and MariaDB 12.2.2.

Scoring

CVSS 3.19.9 (CRITICAL)
VectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
EPSS0.86% probability of exploitation · percentile 53.6% · 2026-06-18T12:00:27Z
Published2026-03-20
Last modified2026-03-31

Underlying weaknesses· 1

CWE-122

References

  1. https://github.com/MariaDB/server/security/advisories/GHSA-4rj5-2227-9wgc
  2. https://jira.mariadb.org/browse/MDEV-38356

1

TypeTargetConfidenceTier
WeaknessHeap-based Buffer Overflowcwe-1220%live

Related by meaning· 6

Nearest entities by semantic similarity across the cs-graph corpus.

CVE
CVE-2026-35549
CVE
CVE-2026-9740
CVE
CVE-2026-9750
CVE
CVE-2026-22730
CVE
CVE-2026-33120
CVE
CVE-2026-33210
Sourced from NVD + FIRST.org EPSS. Curated for EU compliance use cases by Adam Lundqvist, Founder at SQUR.