# CVE-2026-107815: MariaDB CONNECT engine buffer overflow in DOS table

Source: https://junglewise.ai/threats/cve-2026-107815-mariadb-server-is-a-community-developed-fork-of-mysql-server  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-09. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-107815 · Severity: high · CVSS 8.5 · Published 2026-10-09

MariaDB is a widely-used open-source database server that powers applications from web services to data analytics platforms. The CONNECT engine, a storage plugin that allows access to external data sources, contains a boundary check flaw that allows an authenticated database user to write one byte beyond a stack buffer at a controlled offset, potentially crashing the database or executing arbitrary code on the server.

Technologies: [Mariadb](https://junglewise.ai/threats/technologies/mariadb), [MariaDB Server](https://junglewise.ai/threats/technologies/mariadb-mariadb-server). Vendors: [Mariadb](https://junglewise.ai/threats/vendors/mariadb).

## Quick answers

**Is CVE-2026-107815 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-107815 being exploited in the wild.

**How severe is CVE-2026-107815?** High severity, with a CVSS score of 8.5, published 9 October 2026.

**Which products and versions are affected?** MariaDB Server 10.6.1 through 10.6.28, 10.11 before 10.11.19, 11.4 before 11.4.13, 11.8 before 11.8.9, 12.3 before 12.3.3, 13.0 before 13.0.2.

**Is there a fix for CVE-2026-107815?** Yes: fixed in 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, 13.0.2. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-107815 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-107815?** Check whether you run Mariadb or MariaDB Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, 13.0.2

## Technical details

The CONNECT engine's DOS table type uses an incorrect boundary check when processing double-precision floating-point values, permitting a one-byte null write beyond a stack buffer at an attacker-controlled offset. An authenticated attacker with permission to use the CONNECT engine can trigger this buffer overflow by crafting a malicious query, leading to denial of service or potentially remote code execution.

## Affected products

- MariaDB MariaDB Server 10.6.1 through 10.6.28, 10.11 before 10.11.19, 11.4 before 11.4.13, 11.8 before 11.8.9, 12.3 before 12.3.3, 13.0 before 13.0.2

## Timeline

- 2026-10-09: disclosed

## References

- [https://github.com/MariaDB/server/commit/b369925f6855d3e1f0ebcf453492724b99fda6f8](https://github.com/MariaDB/server/commit/b369925f6855d3e1f0ebcf453492724b99fda6f8)
- [https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19](https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19)

## Related threats

- [MariaDB ALTER TABLE filename encoding bypass in CONVERT PARTITION](https://junglewise.ai/threats/cve-2026-102523-mariadb-server-is-a-community-developed-fork-of-mysql-server)
- [MariaDB GRANT PROXY authorization bypass with empty password](https://junglewise.ai/threats/cve-2026-97380-mariadb-server-is-a-community-developed-fork-of-mysql-server-from)
- [MariaDB server table name encoding bypass via #mysql50# prefix](https://junglewise.ai/threats/cve-2026-92262-mariadb-server-is-a-community-developed-fork-of-mysql-server-from)
- [MariaDB SQL injection in SHOW CREATE and mariadb-dump](https://junglewise.ai/threats/cve-2026-86047-mariadb-server-is-a-community-developed-fork-of-mysql-server-from)
- [MariaDB CONNECT engine file access bypass in JSON UDFs](https://junglewise.ai/threats/cve-2026-85985-mariadb-server-is-a-community-developed-fork-of-mysql-server-from)