CVE-2026-32710

MariaDB server is a community developed fork of MySQL server. An authenticated user can crash MariaDB versions 11.4 before 11.4.10 and 11.8 before 11.8.6 via a bug in JSONSCHEMAVALID() function. Under certain conditions it might be possible to turn the crash into a remote code execution. These conditions require tight control over memory layout which is generally only attainable in a lab environment. This issue is fixed in MariaDB 11.4.10, MariaDB 11.8.6, and MariaDB 12.2.2.

Database specific

{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/32xxx/CVE-2026-32710.json",
    "cwe_ids": [
        "CWE-122"
    ],
    "cna_assigner": "GitHub_M"
}

References

Affected packages

Git / github.com/mariadb/server

Affected ranges

Type: GIT
Repo: https://github.com/mariadb/server
Events: Introduced

70117463f032d59f8e328335e19b59157d34cf07

Fixed

d26a6f44c1f2119377e79a9540886c6d8c01472f

Database specific

vanir_signatures

[
    {
        "deprecated": false,
        "target": {
            "file": "sql/sp_instr.cc"
        },
        "digest": {
            "line_hashes": [
                "331495033010792057398295084692551616862",
                "178889473583969224685848879336469251622",
                "72995215509533274417683389386874442936",
                "34733286214113447932010597917174327234",
                "220595837734737098186096626766433509208",
                "338750869998908232338240892716586972189",
                "200331074068810549623743321810491183265",
                "318528549273668054390962137954896768015",
                "26834430279848683763735550481300098934",
                "68590751291616411132278116452337632760",
                "155245705888256277018230600879388905005",
                "281201383801172153236642507346466029898",
                "11578098737963444869029556637210276545",
                "88679534638751502059684342659870334045",
                "174412566811641505963715332693034819441",
                "212479306865523010564552785282223352918",
                "264094808494796852436130642367514195992"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-32710-22eb6579",
        "source": "https://github.com/mariadb/server/commit/d26a6f44c1f2119377e79a9540886c6d8c01472f",
        "signature_type": "Line",
        "signature_version": "v1"
    },
    {
        "deprecated": false,
        "target": {
            "file": "sql/sp_instr.h"
        },
        "digest": {
            "line_hashes": [
                "333736738574052575197108677744715005253",
                "262810137784205432405179339402165348111",
                "118178308854161151067014370856362614751",
                "10257631431620263937293216233444103471"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-32710-f170ab29",
        "source": "https://github.com/mariadb/server/commit/d26a6f44c1f2119377e79a9540886c6d8c01472f",
        "signature_type": "Line",
        "signature_version": "v1"
    },
    {
        "deprecated": false,
        "target": {
            "function": "sp_lex_instr::parse_expr",
            "file": "sql/sp_instr.cc"
        },
        "digest": {
            "length": 2658.0,
            "function_hash": "47421469537526624674199985998928255848"
        },
        "id": "CVE-2026-32710-fe069a50",
        "source": "https://github.com/mariadb/server/commit/d26a6f44c1f2119377e79a9540886c6d8c01472f",
        "signature_type": "Function",
        "signature_version": "v1"
    }
]

source

"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-32710.json"

vanir_signatures_modified

"2026-05-30T05:38:42Z"