CVE-2026-107815

A flaw was found in MariaDB. An authenticated user with permission to use the CONNECT storage engine can exploit an incorrect boundary check when handling DOS table types to write beyond the allocated stack buffer. This flaw could lead to arbitrary code execution or cause the database server to crash, resulting in a Denial of Service (DoS).

This vulnerability is rated as an Important impact for Red Hat Enterprise Linux because it could allow an authenticated database user to corrupt stack memory and execute arbitrary code or trigger a denial of service. The risk is reduced in standard configurations because the CONNECT storage engine is shipped as an optional subpackage and is not enabled by default. Exploitation is therefore restricted to systems where this optional engine has been explicitly installed and untrusted users have been granted permissions to query or define CONNECT tables.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Upgrade to the fixed version of MariaDB Server