CVE Tracker

CVE-2026-107815 @ Matrix

Status
new
Priority
5.05
Match score
4.0
Risk
RCE MemCorrupt DoS Remote priv:user
CVSS
8.5 HIGH
Reason
cpe: mariadb; pkgs: mariadb-common; version: in-range: mariadb-common-10.11.18-0+deb12u1; risk:rce; remote
Created
2026-10-15T10:20:33Z
Updated
2026-10-20T10:18:42Z

Package interrogation (copy)

Run on the host — click to copy a command. Debian/apt

PackageCommands
mariadb-common-10.11.18-0+deb12u1
mariadb
libmariadb3-1:10.11.18-0+deb12u1
mariadb-common-1:10.11.18-0+deb12u1

Inventory lookup

Search package inventory across systems, then return here. Create a ticket on systems the matcher missed.

Suggestions: mariadb-common · mariadb

Same product CVEs in your queue

Other open tickets that look like the same product. Closed tickets are omitted unless they are already pegged to this CVE.

CVECVSSKEVSystemsStatus MatchedAlready related
CVE-2026-107818 8.4 Matrix new mariadb —
CVE-2026-107814 8.4 Matrix new mariadb —
CVE-2026-107821 8.0 Matrix new mariadb —
CVE-2022-0778 7.5 Library, mufasa new mariadb —
CVE-2026-107823 7.2 Matrix new mariadb —

Related CVE (same fix)

Point this ticket’s CVE at a higher-priority / same-fix primary so you only triage one.

Host OS / kernel

OS
Debian GNU/Linux 12 (bookworm) (12) · debian
Arch
x86_64
kernel_release
uname -r → 6.1.0-52-amd64
kernel_version
uname -v → #1 SMP PREEMPT_DYNAMIC Debian 6.1.180-1 (2026-08-03)

For Linux kernel CVEs, kernel_version (Debian packaging / build string) often decides fixed vs not; kernel_release is used for upstream NVD range compares.

Description

MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the CONNECT engine's DOS table type used an incorrect boundary check that permitted a one-byte null write beyond a stack buffer at an attacker-controlled offset. An authenticated user able to use the CONNECT engine could cause a crash and potentially remote code execution. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.

Update status

Add note only

References

NVD: CVE-2026-107815