CVE-2026-44172

A flaw was found in MariaDB server. An application processing non-validated user input, which then uses mysql_real_escape_string() and sends data to the database via text protocol with the big5 character set, is vulnerable to SQL injection. This allows a remote attacker to execute malicious SQL commands, potentially leading to unauthorized data access or modification within the database.

This is an Important SQL injection vulnerability in MariaDB server affecting applications that utilize mysql_real_escape_string() with non-validated user input and the big5 character set. Exploitation allows a remote attacker to execute arbitrary SQL commands, potentially compromising data integrity and confidentiality within the database. The specific configuration required for exploitation limits its widespread impact, but systems configured in this manner are at significant risk.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.