---
cve: "CVE-2026-107816"
severity: "MEDIUM"
cvss: 6.4
epss: "0.3%"
vendor: "MariaDB"
kev: false
exploited: false
published: "2026-10-09 18:17:03"
tags: [cve, security, medium]
source: tsecurity.de CVE-Dossier
exported: "2026-10-23T09:34:18+02:00"
---

# CVE-2026-107816

> 6.4 MEDIUM · 🧪 PoC

## Beschreibung

MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the qc_info plugin could be confused by a query containing embedded null bytes. Reading information_schema.query_cache_info after such a query was cached could access data beyond the end of a heap-allocated buffer, potentially disclosing adjacent memory or crashing the server. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.

## CNA-Record (Kanon, cvelistV5)

- CNA: **GitHub_M**
- State: PUBLISHED
- Stand: 2026-10-13 20:27:21
- CNA-CVSS: **6.4** (`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:L`)

## CISA-Anreicherung (vulnrichment/ADP)

- CISA-SSVC (Coordinator, v2.0.3):
  - Exploitation: **none**
  - Automatable: **no**
  - Technical Impact: **partial**

## CVSS-Vektor

```
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:L
```

| Metrik | Wert | Bewertung |
|---|---|---|
| AV Angriffsvektor | Netzwerk | bad |
| AC Komplexität | Gering | bad |
| PR Privilegien | Gering | warn |
| UI Interaktion | Keine | bad |
| S Scope | Verändert | bad |
| C Vertraulichkeit | Gering | warn |
| I Integrität | Keine | good |
| A Verfügbarkeit | Gering | warn |

## Schwachstellen-Klasse

- **CWE-125** — Out-of-bounds Read
  The product reads data past the end, or before the beginning, of the intended buffer.

## Angriffsmuster (CAPEC)

- [CAPEC-540 — Overread Buffers](https://capec.mitre.org/data/definitions/540.html) _(Severity: High)_

## Patch verfügbar (OSV)

- 210ab6edf47fa73f3b77e974ed2e9357ccdd051c (Commit)
- 93e051860a9c7e87ee8cee6ed38b640d491f7170 (Commit)

## BSI-Hinweise (deutsch)

- [MariaDB: Mehrere Schwachstellen](https://wid.cert-bund.de/portal/wid/sicherheitshinweis/WID-SEC-W-2026-3856) — _BSI-Einstufung: hoch_
  Ein Angreifer kann mehrere Schwachstellen in MariaDB ausnutzen, um beliebigen Programmcode auszuführen, um seine Privilegien zu erhöhen, um einen Denial of Service Angriff durchzuführen, um Informationen offenzulegen und um Sicherheitsvorkehrungen zu umgehen.

## Referenzen

- <https://github.com/MariaDB/server/security/advisories/GHSA-wfqg-88r5-55f6>
- <https://github.com/MariaDB/server/commit/0931994096b84ecc9ffc8eb3517c7e09e6e8631e>
- <https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19>
- <https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28>
- <https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13>
- <https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9>
- <https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3>
- <https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2>
- <https://jira.mariadb.org/browse/MDEV-40670>

---
_Exportiert aus dem [tsecurity.de CVE-Dossier](https://tsecurity.de/sicherheitsluecken/cve-2026-107816/) · Datenquellen: EUVD (ENISA), NVD, OSV, CISA KEV, FIRST EPSS, Exploit-DB, BSI WID (CSAF)_