CVE Tracker

CVE-2026-107821 @ Matrix

Status
new
Priority
2.4
Match score
4.0
Risk
InfoLeak MemCorrupt DoS Remote priv:user
CVSS
8.0 HIGH
Reason
cpe: mariadb; pkgs: mariadb-common; version: in-range: mariadb-common-10.11.18-0+deb12u1; risk:info_disclosure
Created
2026-10-15T10:20:33Z
Updated
2026-10-20T10:18:42Z

Package interrogation (copy)

Run on the host — click to copy a command. Debian/apt

PackageCommands
mariadb-common-10.11.18-0+deb12u1
mariadb
libmariadb3-1:10.11.18-0+deb12u1
mariadb-common-1:10.11.18-0+deb12u1

Inventory lookup

Search package inventory across systems, then return here. Create a ticket on systems the matcher missed.

Clear

Suggestions: mariadb-common · mariadb

SystemMatchesTicket for CVE-2026-107821
Matrix libmariadb3 1:10.11.18-0+deb12u1; mariadb-common 1:10.11.18-0+deb12u1 new open
Helios libmariadb3 1:10.5.29-0+deb11u1; mariadb-common 1:10.5.29-0+deb11u1 none
Janus libmariadb3 1:10.3.39-0+deb10u2; mariadb-common 1:10.3.39-0+deb10u2 none
Library libmariadbclient18 10.1.48-0+deb9u2; mariadb-client-10.0 10.0.32-0+deb8u1; mariadb-client-10.1 10.1.48-0+deb9u2; mariadb-client-core-10.1 10.1.48-0+deb9u2; mariadb-common 10.1.48-0+deb9u2; mariadb-server 10.1.48-0+deb9u2; mariadb-server-10.0 10.0.32-0+deb8u1; mariadb-server-10.1 10.1.48-0+deb9u2 (+1 more) none
Saiph libmariadb3 1:10.3.39-0+deb10u2; mariadb-client-10.0 10.0.30-0+deb8u2; mariadb-client-10.1 10.1.41-0+deb9u1; mariadb-client-10.3 1:10.3.39-0+deb10u2; mariadb-client-core-10.3 1:10.3.39-0+deb10u2; mariadb-common 1:10.3.39-0+deb10u2; mariadb-server 1:10.3.39-0+deb10u2; mariadb-server-10.0 10.0.30-0+deb8u2 (+3 more) none
Silk libdbd-mariadb-perl 1.22-1+b1; libmariadb-dev 1:10.11.19-0+deb12u1; libmariadb3 1:10.11.19-0+deb12u1; mariadb-client 1:10.11.19-0+deb12u1; mariadb-client-core 1:10.11.19-0+deb12u1; mariadb-common 1:10.11.19-0+deb12u1; mariadb-plugin-provider-bzip2 1:10.11.19-0+deb12u1; mariadb-plugin-provider-lz4 1:10.11.19-0+deb12u1 (+5 more) none
morris alt-php44-mariadb10 4.4.9; alt-php44-mariadb101 4.4.9; alt-php44-mariadb102 4.4.9; alt-php44-mariadb103 4.4.9; alt-php44-mariadb104 4.4.9; alt-php44-mariadb105 4.4.9; alt-php44-mariadb106 4.4.9; alt-php51-mariadb10 5.1.6 (+155 more) none
mufasa alt-php56-mariadb10 5.6.40; alt-php56-mariadb101 5.6.40; alt-php56-mariadb1011 5.6.40; alt-php56-mariadb102 5.6.40; alt-php56-mariadb103 5.6.40; alt-php56-mariadb104 5.6.40; alt-php56-mariadb105 5.6.40; alt-php56-mariadb106 5.6.40 (+40 more) none

Same product CVEs in your queue

Other open tickets that look like the same product. Closed tickets are omitted unless they are already pegged to this CVE.

CVECVSSKEVSystemsStatus MatchedAlready related
CVE-2026-107815 8.5 Matrix new mariadb —
CVE-2026-107818 8.4 Matrix new mariadb —
CVE-2026-107814 8.4 Matrix new mariadb —
CVE-2022-0778 7.5 Library, mufasa new mariadb —
CVE-2026-107823 7.2 Matrix new mariadb —

Related CVE (same fix)

Point this ticket’s CVE at a higher-priority / same-fix primary so you only triage one.

Host OS / kernel

OS
Debian GNU/Linux 12 (bookworm) (12) · debian
Arch
x86_64
kernel_release
uname -r → 6.1.0-52-amd64
kernel_version
uname -v → #1 SMP PREEMPT_DYNAMIC Debian 6.1.180-1 (2026-08-03)

For Linux kernel CVEs, kernel_version (Debian packaging / build string) often decides fixed vs not; kernel_release is used for upstream NVD range compares.

Description

MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB insufficiently validated counts, offsets, lengths, and field boundaries in FRM metadata while opening binary FRM files. An attacker able to place a crafted FRM file in the data directory could trigger out-of-bounds reads or writes, crash the server, or potentially execute code. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.

Update status

Add note only

References

NVD: CVE-2026-107821