Is CVE-2026-107821 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-107821 being exploited in the wild.

How severe is CVE-2026-107821?

High severity, with a CVSS score of 8, published 9 October 2026.

Which products and versions are affected?

MariaDB Server 10.6.1 through 10.6.27, 10.11.0 through 10.11.18, 11.4.0 through 11.4.12, 11.8.0 through 11.8.8, 12.3.0 through 12.3.2, 13.0.0 through 13.0.1.

Is there a fix for CVE-2026-107821?

Yes: fixed in MariaDB Server 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, 13.0.2. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-107821 attacked?

It is attacked with local access, in a software library.

Am I affected by CVE-2026-107821?

Check whether you run Mariadb or MariaDB Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-107821: MariaDB server buffer overflow in FRM metadata validation

CVE-2026-107821 · Severity: high · CVSS 8 · Published 2026-10-09

MariaDB server is a database management system used to store and retrieve business data. When opening specially crafted table definition files (FRM files), the database fails to properly validate file metadata, allowing an attacker with local file placement access to cause the database to crash, read sensitive data, or execute malicious code. This affects multiple versions across the 10.6 through 13.0 release lines.

Technologies: Mariadb, MariaDB Server. Vendors: Mariadb.

Quick answers

Is CVE-2026-107821 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-107821 being exploited in the wild.
How severe is CVE-2026-107821?: High severity, with a CVSS score of 8, published 9 October 2026.
Which products and versions are affected?: MariaDB Server 10.6.1 through 10.6.27, 10.11.0 through 10.11.18, 11.4.0 through 11.4.12, 11.8.0 through 11.8.8, 12.3.0 through 12.3.2, 13.0.0 through 13.0.1.
Is there a fix for CVE-2026-107821?: Yes: fixed in MariaDB Server 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, 13.0.2. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-107821 attacked?: It is attacked with local access, in a software library.
Am I affected by CVE-2026-107821?: Check whether you run Mariadb or MariaDB Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: MariaDB Server 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, 13.0.2

Technical details

The vulnerability stems from insufficient validation of counts, offsets, lengths, and field boundaries when parsing binary FRM (table definition) files. An attacker who can place a malicious FRM file in the data directory can trigger out-of-bounds reads or writes in the server process. The fix adds comprehensive validation checks to ensure FRM metadata is internally consistent before use.

Affected products

MariaDB MariaDB Server 10.6.1 through 10.6.27, 10.11.0 through 10.11.18, 11.4.0 through 11.4.12, 11.8.0 through 11.8.8, 12.3.0 through 12.3.2, 13.0.0 through 13.0.1

Timeline

2026-10-09: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.