CVE-2026-32710
Heap-based Buffer Overflow in MariaDB
Reported by github_m · Published March 20, 2026
MariaDB server is a community developed fork of MySQL server. An authenticated user can crash MariaDB versions 11.4 before 11.4.10 and 11.8 before 11.8.6 via a bug in JSON_SCHEMA_VALID() function. Under certain conditions it might be possible to turn the crash into a remote code execution. These conditions require tight control over memory layout which is generally only attainable in a lab environment. This issue is fixed in MariaDB 11.4.10, MariaDB 11.8.6, and MariaDB 12.2.2.
Fixed versions
Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.
| Package | Ecosystem | Fixed in |
|---|---|---|
| mariadb-embedded-debuginfo | errata.rockylinux.org | 11.8.6-2.module |
| galera-debuginfo | errata.rockylinux.org | 26.4.25-1.el10 |
| mariadb-client-utils | errata.rockylinux.org | 11.8.6-2.module |
| mariadb-server-galera-debuginfo | errata.rockylinux.org | 11.8.6-2.module |
| mariadb-oqgraph-engine-debuginfo | errata.rockylinux.org | 11.8.6-2.module |
| mariadb-server-debuginfo | errata.rockylinux.org | 11.8.6-2.module |
| mariadb11.8-server-utils | errata.rockylinux.org | 11.8.6-2.el10 |
| mariadb-min | Bitnami | 12.2.2, 11.8.6, 11.4.10 |
| mariadb-gssapi-server-debuginfo | errata.rockylinux.org | 11.8.6-2.module |
| mariadb-server | errata.rockylinux.org | 11.8.6-2.module |
| mariadb-common | errata.rockylinux.org | 11.8.6-2.module |
| mariadb11.8 | errata.rockylinux.org | 11.8.6-2.el10 |
29 more packages have a fixed version. See every fix in Lookup.
Risk scores
Affected products
| Vendor | Product | Versions |
|---|---|---|
| MariaDB | server | >= 11.4.1, < 11.4.10, >= 11.8.1, < 11.8.6, >= 12.1.2, < 12.2.2 |
| wolfi | mariadb-11.8 | 0 |
| chainguard | mariadb-11.8 | 0 |
| MariaDB | server | 11.4.1, 11.8.1, 12.1.2 |
Timeline
- Mar 20, 2026 CVE Published
- Mar 20, 2026 PoC Published (7 in total, the first dated here)
- Mar 21, 2026 EPSS Score (30 in total, the first dated here)
- Mar 22, 2026 Coalition ESS Score (2 in total, the first dated here)
- Mar 27, 2026 CVE Updated
- May 29, 2026 Distribution Patch (4 in total, the first dated here)
- May 29, 2026 Security Advisory (5 in total, the first dated here)
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln CVE-2026-32710
vulnetix vdb fixes CVE-2026-32710Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/CVE-2026-32710/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart
References
- https://github.com/MariaDB/server/security/advisories/GHSA-4rj5-2227-9wgc x_refsource_CONFIRM
- https://jira.mariadb.org/browse/MDEV-38356 x_refsource_MISC