CVE-2026-32710 Heap-based Buffer Overflow in MariaDB
An authenticated user can crash MariaDB via a heap buffer overflow in JSON_SCHEMA_VALID, potentially leading to remote code execution under specific memory conditions.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-32710?
CVE-2026-32710 is a high-severity memory corruption vulnerability in Mariadb Mariadb, published on 20 Mar 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
MariaDB server is a community developed fork of MySQL server. An authenticated user can crash MariaDB versions 11.4 before 11.4.10 and 11.8 before 11.8.6 via a bug in JSON_SCHEMA_VALID() function. Under certain conditions it might be possible to turn the crash into a remote code execution. These conditions require tight control over memory layout which is generally only attainable in a lab environment. This issue is fixed in MariaDB 11.4.10, MariaDB 11.8.6, and MariaDB 12.2.2.
Weakness: CWE-122
Which versions are affected by CVE-2026-32710?
3 open source packages ship an affected version, including mariadb, mariadb-min and mysql-client. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
mariadb Bitnami | From 11.4.1 | 11.4.10, 11.8.6, 12.2.2 |
mariadb-min Bitnami | From 11.4.1 | 11.4.10, 11.8.6, 12.2.2 |
mysql-client Bitnami | From 11.4.1 | 11.4.10, 11.8.6, 12.2.2 |
Linux distribution packages (37)
galera Red Hat:enterprise_linux:10.2 | All versions | 0:26.4.25-1.el10_2 |
galera-debuginfo Red Hat:enterprise_linux:10.2 | All versions | 0:26.4.25-1.el10_2 |
galera-debugsource Red Hat:enterprise_linux:10.2 | All versions | 0:26.4.25-1.el10_2 |
mariadb11.8 Red Hat:enterprise_linux:10.2 | All versions | 3:11.8.6-2.el10_2 |
mariadb11.8-backup Red Hat:enterprise_linux:10.2 | All versions | 3:11.8.6-2.el10_2 |
mariadb11.8-backup-debuginfo Red Hat:enterprise_linux:10.2 | All versions | 3:11.8.6-2.el10_2 |
mariadb11.8-client-utils Red Hat:enterprise_linux:10.2 | All versions | 3:11.8.6-2.el10_2 |
mariadb11.8-common Red Hat:enterprise_linux:10.2 | All versions | 3:11.8.6-2.el10_2 |
mariadb11.8-debuginfo Red Hat:enterprise_linux:10.2 | All versions | 3:11.8.6-2.el10_2 |
mariadb11.8-debugsource Red Hat:enterprise_linux:10.2 | All versions | 3:11.8.6-2.el10_2 |
mariadb11.8-devel Red Hat:enterprise_linux:10.2 | All versions | 3:11.8.6-2.el10_2 |
mariadb11.8-embedded Red Hat:enterprise_linux:10.2 | All versions | 3:11.8.6-2.el10_2 |
mariadb11.8-embedded-debuginfo Red Hat:enterprise_linux:10.2 | All versions | 3:11.8.6-2.el10_2 |
mariadb11.8-embedded-devel Red Hat:enterprise_linux:10.2 | All versions | 3:11.8.6-2.el10_2 |
mariadb11.8-errmsg Red Hat:enterprise_linux:10.2 | All versions | 3:11.8.6-2.el10_2 |
mariadb11.8-gssapi-server Red Hat:enterprise_linux:10.2 | All versions | 3:11.8.6-2.el10_2 |
mariadb11.8-gssapi-server-debuginfo Red Hat:enterprise_linux:10.2 | All versions | 3:11.8.6-2.el10_2 |
mariadb11.8-oqgraph-engine Red Hat:enterprise_linux:10.2 | All versions | 3:11.8.6-2.el10_2 |
mariadb11.8-oqgraph-engine-debuginfo Red Hat:enterprise_linux:10.2 | All versions | 3:11.8.6-2.el10_2 |
mariadb11.8-pam Red Hat:enterprise_linux:10.2 | All versions | 3:11.8.6-2.el10_2 |
mariadb11.8-pam-debuginfo Red Hat:enterprise_linux:10.2 | All versions | 3:11.8.6-2.el10_2 |
mariadb11.8-server Red Hat:enterprise_linux:10.2 | All versions | 3:11.8.6-2.el10_2 |
mariadb11.8-server-debuginfo Red Hat:enterprise_linux:10.2 | All versions | 3:11.8.6-2.el10_2 |
mariadb11.8-server-galera Red Hat:enterprise_linux:10.2 | All versions | 3:11.8.6-2.el10_2 |
mariadb11.8-server-galera-debuginfo Red Hat:enterprise_linux:10.2 | All versions | 3:11.8.6-2.el10_2 |
mariadb11.8-server-utils Red Hat:enterprise_linux:10.2 | All versions | 3:11.8.6-2.el10_2 |
mariadb11.8-test Red Hat:enterprise_linux:10.2 | All versions | 3:11.8.6-2.el10_2 |
mariadb11.8-test-debuginfo Red Hat:enterprise_linux:10.2 | All versions | 3:11.8.6-2.el10_2 |
galera Red Hat:enterprise_linux:9::appstream | All versions | 0:26.4.25-1.module+el9.8.0+24146+e179c349 |
galera-debuginfo Red Hat:enterprise_linux:9::appstream | All versions | 0:26.4.25-1.module+el9.8.0+24146+e179c349 |
galera-debugsource Red Hat:enterprise_linux:9::appstream | All versions | 0:26.4.25-1.module+el9.8.0+24146+e179c349 |
mariadb Red Hat:enterprise_linux:9::appstream | All versions | 3:11.8.6-2.module+el9.8.0+24146+e179c349 |
mariadb-backup Red Hat:enterprise_linux:9::appstream | All versions | 3:11.8.6-2.module+el9.8.0+24146+e179c349 |
mariadb-backup-debuginfo Red Hat:enterprise_linux:9::appstream | All versions | 3:11.8.6-2.module+el9.8.0+24146+e179c349 |
mariadb-client-utils Red Hat:enterprise_linux:9::appstream | All versions | 3:11.8.6-2.module+el9.8.0+24146+e179c349 |
mariadb-common Red Hat:enterprise_linux:9::appstream | All versions | 3:11.8.6-2.module+el9.8.0+24146+e179c349 |
mariadb-debuginfo Red Hat:enterprise_linux:9::appstream | All versions | 3:11.8.6-2.module+el9.8.0+24146+e179c349 |
Products include Mariadb Mariadb.
How do I fix CVE-2026-32710?
Upgrade mariadb to a fixed version for your release line: 11.4.10, 11.8.6 or 12.2.2.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-32710 being exploited?
There is no known exploitation of CVE-2026-32710 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in Mariadb Mariadb
- CVE-2026-49261 MariaDB server has unsafe parameter handling in `wsrep_notify_cmd`
- CVE-2026-85746 MariaDB: Out-of-bound buffer write on in `ST_AsText` of nested GeometryCollections
- CVE-2026-85748 MariaDB: Use-after-free with a large number of SYS_REFCURSOR's
- CVE-2026-92262 MariaDB: Numerous issues caused by historical #mysql50# tablename encoding bypass.
- CVE-2023-26785 Code injection in n/a
Sources
Also known as BELL-CVE-2026-32710, BIT-mariadb-2026-32710, BIT-mariadb-min-2026-32710, BIT-mysql-client-2026-32710, DEBIAN-CVE-2026-32710, GHSA-4rj5-2227-9wgc and 13 more.