CVE Tracker

CVE-2026-107818 @ Matrix

Status
new
Priority
2.52
Match score
4.0
Risk
MemCorrupt Remote priv:user
CVSS
8.4 HIGH
Reason
cpe: mariadb; pkgs: mariadb-common; version: in-range: mariadb-common-10.11.18-0+deb12u1; risk:memory_corruption
Created
2026-10-15T10:20:33Z
Updated
2026-10-20T10:18:42Z

Package interrogation (copy)

Run on the host — click to copy a command. Debian/apt

PackageCommands
mariadb-common-10.11.18-0+deb12u1
mariadb
libmariadb3-1:10.11.18-0+deb12u1
mariadb-common-1:10.11.18-0+deb12u1

Inventory lookup

Search package inventory across systems, then return here. Create a ticket on systems the matcher missed.

Suggestions: mariadb-common · mariadb

Same product CVEs in your queue

Other open tickets that look like the same product. Closed tickets are omitted unless they are already pegged to this CVE.

CVECVSSKEVSystemsStatus MatchedAlready related
CVE-2026-107815 8.5 Matrix new mariadb —
CVE-2026-107814 8.4 Matrix new mariadb —
CVE-2026-107821 8.0 Matrix new mariadb —
CVE-2022-0778 7.5 Library, mufasa new mariadb —
CVE-2026-107823 7.2 Matrix new mariadb —

Related CVE (same fix)

Point this ticket’s CVE at a higher-priority / same-fix primary so you only triage one.

Host OS / kernel

OS
Debian GNU/Linux 12 (bookworm) (12) · debian
Arch
x86_64
kernel_release
uname -r → 6.1.0-52-amd64
kernel_version
uname -v → #1 SMP PREEMPT_DYNAMIC Debian 6.1.180-1 (2026-08-03)

For Linux kernel CVEs, kernel_version (Debian packaging / build string) often decides fixed vs not; kernel_release is used for upstream NVD range compares.

Description

MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the mariadb.service unit used /run/mysqld/wsrep-new-cluster during the next service restart. A database user with FILE privilege and a secure-file-priv configuration permitting writes to /run/mysqld could create that file and inject attacker-controlled environment values into the restarted service. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.

Update status

Add note only

References

NVD: CVE-2026-107818