DEBIAN-CVE-2026-32710

See a problem?
Please try reporting it to the source first.

Source

https://security-tracker.debian.org/tracker/CVE-2026-32710

Import Source

https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-32710.json

JSON Data

https://api.osv.dev/v1/vulns/DEBIAN-CVE-2026-32710

Upstream

CVE-2026-32710

Published

2026-03-20T19:16:16Z

Modified

2026-09-14T17:03:27Z

Severity

9.9 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H CVSS Calculator

Summary

[none]

Details

MariaDB server is a community developed fork of MySQL server. An authenticated user can crash MariaDB versions 11.4 before 11.4.10 and 11.8 before 11.8.6 via a bug in JSON_SCHEMA_VALID() function. Under certain conditions it might be possible to turn the crash into a remote code execution. These conditions require tight control over memory layout which is generally only attainable in a lab environment. This issue is fixed in MariaDB 11.4.10, MariaDB 11.8.6, and MariaDB 12.2.2.

References

https://security-tracker.debian.org/tracker/CVE-2026-32710

Affected packages

Debian:13 / mariadb

Package

Name: mariadb
Purl: pkg:deb/debian/mariadb?arch=source&distro=trixie

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

1:11.8.6-0+deb13u1

Affected versions

1:11.*

1:11.8.2-1

1:11.8.3-0+deb13u1

1:11.8.3-1

1:11.8.5-1

1:11.8.5-2

1:11.8.5-3~exp1

1:11.8.5-3~exp2

1:11.8.5-3~exp3

1:11.8.5-3

1:11.8.5-4

Ecosystem specific

{
    "urgency":  "not yet assigned"
}

Database specific

source

"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-32710.json"

Debian:14 / mariadb