Executive brief
OpenLink Virtuoso is a high-performance database and middleware solution used for managing large-scale data. A vulnerability in how the system processes specific time-related data allows an attacker to crash the database server using specially crafted SQL commands. This results in a denial-of-service, making the database and any dependent applications unavailable to users.
Technical details
A vulnerability exists in the time_t_to_dt component of OpenLink Virtuoso OpenSource v7.2.11. The issue is triggered during a box_cast operation when processing specific malformed DATE values in an INSERT statement, leading to a null pointer dereference or similar memory corruption that crashes the database engine. An attacker with the ability to execute SQL queries against the database can trigger this crash remotely. The vulnerability was identified via fuzzing and confirmed in the beta Docker image for version 7.2.11.
Affected products
- OpenLink Virtuoso OpenSource 7.2.11
Timeline
- 2024-01-07: disclosed: Issue reported on GitHub with PoC
- 2026-06-23: advisory: CVE published by NVD