CVE-2026-107823
An account with CREATE USER and CREATE VIEW WITH GRANT OPTION could create a crafted username containing additional view metadata, causing the parser to interpret part of the username as security metadata and potentially escalating database privileges.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (0.79%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the MariaDB view FRM parser did not safely encode embedded newline characters in a username. An account with CREATE USER and CREATE VIEW WITH GRANT OPTION could create a crafted username containing additional view metadata, causing the parser to interpret part of the username as security metadata and potentially escalating database privileges. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.
- CVSS 3.1
- 7.2 HIGHCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 0.79% probability · 56th percentile
- Public exploits
- None in Exploit-DB
- CISA KEV
- Not listed
- Weakness
- CWE-116, CWE-144
- Affected
- mariadb/mariadb
- Source
- security-advisories@github.com
EPSS moved from 0.4% on 10 October 2026 to 0.8% on 26 October 2026.
References
- https://github.com/MariaDB/server/commit/8a642bc8103aadc6b2087d781ba8e1595616a2c4Patch
- https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19Release Notes
- https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28Release Notes
- https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13Release Notes
- https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9Release Notes
- https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3Release Notes
- https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2Release Notes
- https://github.com/MariaDB/server/security/advisories/GHSA-g2q2-3936-cp37Vendor Advisory
- https://jira.mariadb.org/browse/MDEV-40484Issue Tracking
Source: NVD record, EPSS from FIRST.org, KEV from CISA, exploits from Exploit-DB. Refreshed daily. Download this record as JSON.