MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB insufficiently validated counts, offsets, lengths, and field boundaries in FRM metadata while opening binary FRM files. An attacker able to place a crafted FRM file in the data directory could trigger out-of-bounds reads or writes, crash the server, or potentially execute code. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.
{
"cna_assigner": "GitHub_M",
"cwe_ids": [
"CWE-1285"
],
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/107xxx/CVE-2026-107821.json"
}{
"extracted_events": [
{
"cpe": "cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "10.6.1"
},
{
"fixed": "10.6.28"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "10.11.1"
},
{
"fixed": "10.11.19"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "11.4.1"
},
{
"fixed": "11.4.13"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "11.8.1"
},
{
"fixed": "11.8.9"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "12.3.1"
},
{
"fixed": "12.3.3"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "13.0.1"
},
{
"fixed": "13.0.2"
}
],
"source": "CPE_RANGE"
},
{
"range": [
{
"fixed": "3b1c2e58abab5571bec4ff52773ddc75b1738da9"
}
],
"source": "REFERENCES_COMMIT"
},
{
"original_tag": "mariadb-10.11.19",
"range": [
{
"fixed": "93e051860a9c7e87ee8cee6ed38b640d491f7170"
}
],
"source": "REFERENCES_TAG"
},
{
"original_tag": "mariadb-10.6.28",
"range": [
{
"fixed": "210ab6edf47fa73f3b77e974ed2e9357ccdd051c"
}
],
"source": "REFERENCES_TAG"
},
{
"original_tag": "mariadb-11.4.13",
"range": [
{
"fixed": "170b1d70737be6f134448f51713cdc1ae215b420"
}
],
"source": "REFERENCES_TAG"
},
{
"original_tag": "mariadb-11.8.9",
"range": [
{
"fixed": "bf9193a939f515e95dd8def1a5468088c91cede6"
}
],
"source": "REFERENCES_TAG"
},
{
"original_tag": "mariadb-12.3.3",
"range": [
{
"fixed": "83e909fc2a0dbc394b4b683fb3fa2d7dcf26cc5e"
}
],
"source": "REFERENCES_TAG"
},
{
"original_tag": "mariadb-13.0.2",
"range": [
{
"fixed": "620a4b5624222048fece7fe1789978ae0675cae2"
}
],
"source": "REFERENCES_TAG"
}
]
}
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-107821.json"
[
{
"deprecated": false,
"digest": {
"function_hash": "85676934499880264601416161311707180166",
"length": 743
},
"id": "CVE-2026-107821-02b21eac",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/mariadb/server/commit/3b1c2e58abab5571bec4ff52773ddc75b1738da9",
"target": {
"file": "sql/table.cc",
"function": "mysql57_calculate_null_position"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "82801121302399979878132824021630315459",
"length": 36251
},
"id": "CVE-2026-107821-0f8d0e0f",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/mariadb/server/commit/3b1c2e58abab5571bec4ff52773ddc75b1738da9",
"target": {
"file": "sql/table.cc",
"function": "TABLE_SHARE::init_from_binary_frm_image"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "338418176691477006438878597160865999730",
"length": 892
},
"id": "CVE-2026-107821-18583404",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/mariadb/server/commit/3b1c2e58abab5571bec4ff52773ddc75b1738da9",
"target": {
"file": "sql/table.cc",
"function": "fix_type_pointers"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "339712868486696881928202886484344029960",
"length": 1715
},
"id": "CVE-2026-107821-1cd3e8db",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/mariadb/server/commit/83e909fc2a0dbc394b4b683fb3fa2d7dcf26cc5e",
"target": {
"file": "sql/log_event_server.cc",
"function": "Rows_log_event_fragmenter::fragment"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "213402534861431797481623475064042930965",
"length": 4382
},
"id": "CVE-2026-107821-381a2954",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/mariadb/server/commit/3b1c2e58abab5571bec4ff52773ddc75b1738da9",
"target": {
"file": "sql/table.cc",
"function": "create_key_infos"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"265577632303887446289749120585557906012",
"90338461107598051749602183626527029076",
"135974257990159682542061181314070611477",
"59440921527566409168742990730026725636",
"871135494022066138858656571240698570",
"247293449498909397416026347351022219912",
"179396894775406735805665784479451940140",
"269443033021460921618747189093528286356",
"259691733175197008076763079871985256069",
"102338916828131457031608538914692707050",
"65381815336936246662830619643818353906",
"7100122396357284882133944108516856108",
"161393146120866756988306743699529625075"
],
"threshold": 0.9
},
"id": "CVE-2026-107821-6d62851c",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/mariadb/server/commit/bf9193a939f515e95dd8def1a5468088c91cede6",
"target": {
"file": "sql/item_vectorfunc.cc"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"47920626166564915707844108170553976783",
"57650215753729557298652743605907648451",
"225809051061404070915381110455764440776",
"329599490030046015987457036067652106022",
"193319660483070688359067603731676003494",
"35622306923076348838281878440148078265",
"203814631487698515612775719839566580770",
"20430701255949821678403902881508784752",
"108822724051117439816140179556695960277",
"252710795875484927025242901151726201454",
"60509711634924858389931357711604569829",
"111976337997444070987757836978957439530",
"217924766426042106655051072213055501146",
"217734671666989279310266486004020255549",
"165793228874504239350047061390683139091",
"173926835296080214790079094795002732331",
"124150931242845765664770822028053239015",
"217897647726549134735036968422612797714",
"249816654103949037232494683772654347813",
"273639606732627959764674262759725186825",
"66214329855802435584232323253873310932",
"315855020901247523249227915417143418527",
"181363402731523028042725285378534240400",
"156459243938515428161827965002670856096",
"46957592358107355424593942356612435088",
"289003428063457768165225349285919414583",
"215340652513247402175651994830429604790",
"266391956627514580190748772808271234529",
"245030019918293354095167811210924106475",
"37668838200630339403488218154242275777",
"207536544481733954790939231692370151999",
"276265123614463995527943967540228781344",
"191255820059382776458425933432492173463",
"329979547459370691324710500341560982156",
"99935831713873286433107733642990160918",
"280498848989922555254174523297260100258",
"212111216173735803544448374125015305462",
"136508124913375856298475437832434215918",
"330727715674617723247185777064465418770",
"9829723704366416043140041309864416169",
"291956027271285448872694171931599906930",
"253124555050745286530495932624719245436",
"57114816518475014010631048121337757028",
"232156718642522337025080367427832074340",
"250115227196368677103636807765144507300",
"258263892071093590169127926337004136326",
"316057541348663522596152543543109363301",
"151704139085500231402456307423773859407",
"34865993227858291068707613128235319347",
"100608195931528977946114924182825681373",
"241260501077511663928784498774526653933",
"323790681142721322355371184374327951157",
"285050768946491087692061705598595462361",
"250138610949584734658184005183912520245",
"126615029383846306548930111860096983233",
"227831148539585186124013442740178608430",
"64303277862951263066453535276973574984",
"252444634124267644578696406441233708958",
"125260097882230235897154141736219887120",
"83415268248476385440764954701624744057",
"111068391043389285503642546941773919033",
"24325014432977582242073132680228591702",
"152333992199692693432900713966568169331",
"166786863628273811179391926762909351201",
"77961708057630719847546926247132570350",
"46790822979435331387251122946421087744",
"160476066107976868157830983289696105089",
"63661485043265188537218435702660301476",
"196913870038437546294670547661924446398",
"102535844418965070322885866299748069794",
"99126703657444332130424920567340275367",
"325354178101103049992325167892378799835",
"138950990183746950752292654981277993171",
"60546558158166226592230001388014505843",
"198106492348147784756316366812739501183",
"162461888182177187484044691483432601262",
"334028481016881908171149650743047372108",
"27503157118486121968954311501573962690",
"62810256518856599067595196551768453395",
"266028535541025047590220217536398135102",
"286197980224401279137726318673389010381",
"286970006793084927312100411257875112683",
"198163873432384181944004979869079386818",
"282045108676430846000947132922884454592",
"211083546695665301235956123903590135090",
"145881208698573830182369096787787050771",
"33502979001879773726527012789418608607",
"329917702477661178773197836034233954828",
"201179769969020569874407701786317147689",
"331795995756028679907368817716446746654",
"98086207172201893768496690031373101198",
"107927917864074385135929360236975295369",
"22257218930520138506130840779222024858",
"266800439367647959034124511974441477013",
"42858855567202202764451421231209485061",
"61206600496920825346916454970212094809",
"164650503943347300229986361335730272056",
"240109660535340178630782455452899886909",
"285251407206710014772297831993566445960",
"266864156883082470717025081616966534658",
"117821039734152784061132682697585200262",
"78736565804730449995233310295336093585",
"94490142402566682442552359521534975050",
"154431601115720577168609958797186324197",
"106109335871358716627417199286489014191",
"188643920355965778028127630526583439857",
"337265071749951474109531218425288787542",
"210556729931617222831694249738278968202",
"198927933857576667168765058370841113203",
"266638978014490309876562705588586851669",
"183828463190277264632133947936585093493",
"86418469795573230197891429961734390842",
"308067537378289931955296983152581266833",
"278769536131183903109090487273511999669",
"30512401852697940564563447474273667498",
"66432238535878991020836041849089429228",
"308686295651036217092158695108423277393",
"92390567130675452087234587289929440147",
"276100125935897714589952719957838653674",
"326474391909508774569938428833746281553",
"79254397404682713486085552226184288689",
"241777779855434738989214669324695306892",
"256468376819176870464911353864909475485",
"94431396268200018992295110873467512454",
"247643285568336753941227792646684140381",
"82042691172642668942289378373244062130",
"111728105746253962826678337750589639484",
"177769764167984736073757278113927952920",
"113747906190842097520776326310430654898",
"133363525334858595699273288369912095586",
"18706432842324807646871370362330540752",
"99512207185159297714327620894794493742",
"237699270187219304987768713170079596557",
"64286475938185527060133822188016314420",
"109931064855881032864112300495610321199",
"210945830382036201304241862006228192628",
"153334227148678201619631687451208542490",
"328045658735718164373331478091964967477",
"313260637568555636795500994208115991782",
"86483759542418029836978264678397742113",
"79116618312507289517782658134076089227",
"171138769565019052866564512343788430848",
"89135095225873052322172554603301283716",
"101066078394958450664891766716332369010",
"54226703391799717072687083564430021478",
"268224342465559874799636167186769592936",
"50272590705649515447399560075482709091",
"28064038317311593922517036128557086076",
"143044362687111140975258659381625366189",
"12984081484208620612736333897035379139",
"195330295399697890533927898409000763257",
"130921001538375341412371692065538636174",
"10603349623297612146443498053861202911",
"202400677928611635088212270208596592046",
"185669603723607978582694557777743416266",
"214702942390596159428381246918905598204",
"179510895416611841241916437811736763464",
"271694642017271774812540885236019587389",
"226231396841680225690795407752545092064",
"6872883331479672228684329468599450278",
"119432270245959497932228801349731776975",
"135715979629469434379441833587893621872",
"110538509026094736189061594204587513563",
"272797725656857612473728918234409565260",
"192943199869802597279301457719971063954",
"21752897273309788440308554200722790916",
"147212649824525913456888148341036107720",
"217297195825942812026979938182033838814",
"167620198006533953672081876452697995443",
"48052990745143719889542909969311444888",
"285592443442146971732124708672602712387",
"271732494860671087321895487778943999263",
"149365537118734880382165530162338358771",
"22736045745370602563672248097024315806",
"106553298443918992138319960600670811619",
"186581123098647987638588820525059302212",
"308795727324023880859176970173446082854",
"222773692371921670508223070929759796542",
"9433297535515778704350190748506540706",
"79266908201326817162343066532846171678",
"281805629554070463777294630388145526250",
"23718152588979487055863651781785858565",
"92448127404728281454355087256744479353",
"190366322846178434287983795784251682973",
"273280438789351590234120235185431462689",
"94532614905862558320912230567855371002",
"160084494217174741785486426088244101424",
"232964383609351974653165630123140168969",
"91233867200308378339267076673731689459",
"147856544224703688024508528991541004611",
"122394116883978366157719038646897937475",
"177442148244067130359758793730230431862",
"271215668538068296473788452292973308352",
"153013429866981535157404497884527838781",
"193942817637088005618662047605944810971",
"259034189735616909544866028235806752561",
"89961897874434917106422493426662593749",
"114291869463019632719817252237430865559",
"330803815039592360900954992592866360381",
"238590313866878854289972554921207701588",
"120089998951004730755123702743018348027",
"262251774245078195738586457067153096105",
"215345454667883020344551857752450190531",
"257866915810018103854456452787250210715",
"12892679525510366950052515815375431902",
"288314229257554202140108426163847082354",
"153863725375209641462939985417318406532",
"22442237858430483997386153090614912169",
"329673681004148588465419482637101524903",
"89178284510322076587293340506750192868",
"215812530200173161477455478134851162237",
"334973286924301885818533576542171500791",
"300363938938394140429465916638659824489",
"236157433255326792250125611130060682435",
"97092305787334589365847643090046809251",
"98983931215087708401575363762293727169",
"13012740567980945294784603672852162966",
"145576556003088075764130749458483892113",
"148716150531860900120486999271541184335",
"116219721288140074531523938670109706384",
"117157602344210574688497509179046324919",
"318678295779951336210274694477113231915",
"298970368050343599610954827163987609233",
"52967257833971690443307559281059304381",
"103525305055169760979312044859602221263",
"70096964522201787437761533459951004418",
"204008550138029121275747718326197829340",
"254105904453003291927655303823508590655",
"320073846085226551672990132634391928841",
"207506212071209470350865008930565289747",
"284233392724085004357154050226566667933",
"227199434438924522616938052083085715774",
"326059804283612542720870376992909167965",
"268532987494094125982728156877802289354",
"139351001401713106689858052967748092304",
"55314344695560709654170133603814999745",
"87265567844252006987330775739866835703",
"234060176166982920421882661035477750833",
"190174284430323636376636031392900855049",
"213281422418844949617895981513515303966",
"113319915257879310189859647177057075828",
"232798553559626292160183967221925180548",
"13078653266590214069683083701399393337",
"261649467252164910634475585864337762778",
"191252258764358631487166391587571388201",
"244209487274899263135518382269500833014",
"301621501897516898603245015350352054557",
"61464613730785224590083263609174609515",
"332880954583734203389001808482654477531",
"296696381379930300072316420129990884107",
"72438724835601602347029171956060243185",
"234937906613993309938153813122685985509",
"305487688978903219099987527565499611873",
"232118716673578318188973493512851849923",
"256061543427852088323646595828899592316",
"34212110187111330063940424880234422659",
"220676607240153265078885174555557648947",
"80424426424409789227526517580422498004",
"172872587689778263166252984616400306081",
"206080062868382482169213215492824168215",
"260583995148806489067683432885108762879",
"283572326318496532712224093088184069164",
"334136780359279678813316761295859812144",
"35561755448136761224396848453136525943",
"19396769513815346388774619779697393492",
"8003078916882554976264076817246163783",
"265771204733260914094595547566885235718",
"258317462214870577142944484439338605800",
"3602597199546911571618624265588483692",
"31159972866976672504231479919959150631",
"228950797240722266300025018483925159578",
"293676915528787409420174664436990316150",
"32502110225224070435920156032970203012",
"192966921617423522537325754254072385630",
"21614917312422767682393702358459303672",
"104341854978351922567480055252739733766",
"86487414353506593429254117738345625459",
"24861775919159161879175385026862170539",
"38376576925870097386599125863789763827",
"289835029767527503629957931747142110654",
"197698358461703699480241010268463335746",
"328057992145218445718269413905989593674",
"154508355247439809558812653753238968809",
"142520917764134846458263457819830097021",
"190381486436019279325840948238877507776",
"128327245812144515976506181080490768082",
"75407180318704451699303769443305508093",
"204104360309238309677356920741191334574",
"216672026069995216683305345328879388112",
"283547243460214344190460309889384816737",
"206841859893941800130745778702166899107",
"292581586898788045579197746424247454206",
"73835596629554064866601910803180136075",
"131699735111764835492800531948954488677",
"190793629242997270016645052996827993668",
"69550152385949472593670552606463724523",
"247212470847985409200858861281297443931",
"169266974796689895060413430835367774865",
"238207301567956415084411604841838366720",
"166784208229654748277066250654943127019",
"26415462408762896317024074822543989265",
"295061017862423459284181932087632931603",
"192906121576031241999457975565875376173",
"172689191746539311401958076697756626077",
"287986494631107967662969141947780574649",
"99412790743128044165786196906515607536",
"224046730109237414648496628334168982414",
"115222589816603518846820736754528421346",
"320996143298549011093760646171186647926",
"76560848796519964013190462278591061583"
],
"threshold": 0.9
},
"id": "CVE-2026-107821-8557a9e4",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/mariadb/server/commit/3b1c2e58abab5571bec4ff52773ddc75b1738da9",
"target": {
"file": "sql/table.cc"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "19396654230727680862231874232577326830",
"length": 1414
},
"id": "CVE-2026-107821-96fb114a",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/mariadb/server/commit/210ab6edf47fa73f3b77e974ed2e9357ccdd051c",
"target": {
"file": "sql/sql_acl.cc",
"function": "sp_revoke_privileges"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "73617688475456381632237133958511949829",
"length": 361
},
"id": "CVE-2026-107821-c0933a1f",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/mariadb/server/commit/bf9193a939f515e95dd8def1a5468088c91cede6",
"target": {
"file": "sql/item_vectorfunc.cc",
"function": "Item_func_vec_fromtext::fix_length_and_dec"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"171922335289695664967320282302097012127",
"314879264303882873216162120692739820747",
"296657960952465744719770094395708912555",
"28908880241426286725700820784852115102"
],
"threshold": 0.9
},
"id": "CVE-2026-107821-e432b228",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/mariadb/server/commit/83e909fc2a0dbc394b4b683fb3fa2d7dcf26cc5e",
"target": {
"file": "sql/log_event_server.cc"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"183641122820527899892205997373469390336",
"12095135203163139841028791777804307677",
"261887274333923489567884393156281229573",
"19596961056601881646204718953590518429",
"25158190267319178375799434564910426458",
"79868031186840623159971036872671971261",
"200778640584501115234958299261030732588",
"131021480572983927965383857652169015703",
"259210579588990591926922975771411684670",
"308293174102341777206582901688760031968",
"89478837310948837990084826679872794784",
"338867660209294619394468737325384824268",
"65149555481557669088217935797404683315",
"105820217938288583399134742620391383975",
"267805393157920367530703819131918882708",
"38039493077906535068223160253483389044",
"155248208230518966475406644089911097304",
"209055380163172280650138201893193615240",
"272836316798595100180885698601052815062",
"139632117011298755459574139848637089730",
"112587756624072824044503235660869015796",
"209449771227581042596611529590064743564",
"56162312170597687179668831370098686864",
"315300952757613979287910862404135586893",
"124631588903503696531604192284802908081",
"198447588607325890124688444202645428954",
"277625244959498228703902376649148264741",
"330117756961362545716991630961872097576",
"261593920518145687707482140334066129492",
"310029719624151742354329969579957852433",
"127355466400457567574110878344968834572",
"234782324348854453769025645027188821308",
"4933798797732149183640097703596172566",
"78315220821823291688255278082772905562",
"283495978258419445643401192492072153310",
"289680889044596507883491876189615178669",
"77013134991366103256989980017263461542"
],
"threshold": 0.9
},
"id": "CVE-2026-107821-ebba965d",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/mariadb/server/commit/210ab6edf47fa73f3b77e974ed2e9357ccdd051c",
"target": {
"file": "sql/sql_acl.cc"
}
}
]
"2026-10-22T16:09:13Z"