{"id":"CVE-2026-107821","summary":"MariaDB: insufficient validation of binary frm data when opening a table","details":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB insufficiently validated counts, offsets, lengths, and field boundaries in FRM metadata while opening binary FRM files. An attacker able to place a crafted FRM file in the data directory could trigger out-of-bounds reads or writes, crash the server, or potentially execute code. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.","aliases":["BIT-mariadb-2026-107821","BIT-mariadb-min-2026-107821","BIT-mysql-client-2026-107821","GHSA-c4gx-34mg-95q5"],"modified":"2026-10-22T16:09:13.626078570Z","published":"2026-10-09T17:27:16.316Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/107xxx/CVE-2026-107821.json","cna_assigner":"GitHub_M","cwe_ids":["CWE-1285"]},"references":[{"type":"WEB","url":"https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19"},{"type":"WEB","url":"https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28"},{"type":"WEB","url":"https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13"},{"type":"WEB","url":"https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9"},{"type":"WEB","url":"https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3"},{"type":"WEB","url":"https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2"},{"type":"WEB","url":"https://jira.mariadb.org/browse/MDEV-40571"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/107xxx/CVE-2026-107821.json"},{"type":"ADVISORY","url":"https://github.com/MariaDB/server/security/advisories/GHSA-c4gx-34mg-95q5"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107821"},{"type":"FIX","url":"https://github.com/MariaDB/server/commit/3b1c2e58abab5571bec4ff52773ddc75b1738da9"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/mariadb/server","events":[{"introduced":"00a8357bd30fdfca23720448a3f638290b6d35b7"},{"fixed":"210ab6edf47fa73f3b77e974ed2e9357ccdd051c"},{"introduced":"2437674291f31c91869a74eb6ebd9f03dc52bd43"},{"fixed":"93e051860a9c7e87ee8cee6ed38b640d491f7170"},{"introduced":"fa69b085b10f19a3a8b6e7adab27c104924333ae"},{"fixed":"170b1d70737be6f134448f51713cdc1ae215b420"},{"introduced":"1c4aed7c680c0402d6e97e097f03815c0e9bf4c5"},{"fixed":"bf9193a939f515e95dd8def1a5468088c91cede6"},{"introduced":"21a0714a118614982d20bfa504763d7247800091"},{"fixed":"83e909fc2a0dbc394b4b683fb3fa2d7dcf26cc5e"},{"introduced":"7f923870722c5d382e16d56af526d1ee4e03f987"},{"fixed":"620a4b5624222048fece7fe1789978ae0675cae2"},{"fixed":"3b1c2e58abab5571bec4ff52773ddc75b1738da9"}],"database_specific":{"extracted_events":[{"source":"CPE_RANGE","cpe":"cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*","range":[{"introduced":"10.6.1"},{"fixed":"10.6.28"}]},{"cpe":"cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*","range":[{"introduced":"10.11.1"},{"fixed":"10.11.19"}],"source":"CPE_RANGE"},{"source":"CPE_RANGE","cpe":"cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*","range":[{"introduced":"11.4.1"},{"fixed":"11.4.13"}]},{"cpe":"cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*","range":[{"introduced":"11.8.1"},{"fixed":"11.8.9"}],"source":"CPE_RANGE"},{"range":[{"introduced":"12.3.1"},{"fixed":"12.3.3"}],"source":"CPE_RANGE","cpe":"cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*"},{"cpe":"cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*","range":[{"introduced":"13.0.1"},{"fixed":"13.0.2"}],"source":"CPE_RANGE"},{"range":[{"fixed":"3b1c2e58abab5571bec4ff52773ddc75b1738da9"}],"source":"REFERENCES_COMMIT"},{"range":[{"fixed":"93e051860a9c7e87ee8cee6ed38b640d491f7170"}],"source":"REFERENCES_TAG","original_tag":"mariadb-10.11.19"},{"source":"REFERENCES_TAG","original_tag":"mariadb-10.6.28","range":[{"fixed":"210ab6edf47fa73f3b77e974ed2e9357ccdd051c"}]},{"source":"REFERENCES_TAG","original_tag":"mariadb-11.4.13","range":[{"fixed":"170b1d70737be6f134448f51713cdc1ae215b420"}]},{"original_tag":"mariadb-11.8.9","range":[{"fixed":"bf9193a939f515e95dd8def1a5468088c91cede6"}],"source":"REFERENCES_TAG"},{"original_tag":"mariadb-12.3.3","range":[{"fixed":"83e909fc2a0dbc394b4b683fb3fa2d7dcf26cc5e"}],"source":"REFERENCES_TAG"},{"original_tag":"mariadb-13.0.2","range":[{"fixed":"620a4b5624222048fece7fe1789978ae0675cae2"}],"source":"REFERENCES_TAG"}]}}],"versions":["mariadb-13.0.1","mariadb-10.6.27","mariadb-11.8.7b","mariadb-11.4.11b","mariadb-10.6.26","mariadb-11.8.7","mariadb-11.4.11","mariadb-12.3.1","mariadb-11.8.6","mariadb-11.4.10","mariadb-10.6.25","mariadb-11.8.4","mariadb-11.4.9","mariadb-10.6.24","mariadb-11.8.3","mariadb-10.6.23","mariadb-11.4.8","mariadb-11.8.2","mariadb-10.6.20","mariadb-11.4.7","mariadb-10.6.5","mariadb-11.4.6","mariadb-10.6.22","mariadb-11.8.1","mariadb-11.4.5","mariadb-10.6.21","mariadb-11.4.4","mariadb-10.6.18","mariadb-11.4.3","mariadb-10.6.19","mariadb-10.6.17","mariadb-11.4.2","mariadb-11.4.1","mariadb-10.6.16","mariadb-10.6.12","mariadb-10.6.14","mariadb-10.6.13","mariadb-10.6.11","mariadb-10.6.8","mariadb-10.6.9","mariadb-10.6.10","mariadb-10.6.6","mariadb-10.6.4","mariadb-10.6.3","mariadb-10.6.2","mariadb-10.6.1"],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-107821.json","vanir_signatures":[{"source":"https://github.com/mariadb/server/commit/3b1c2e58abab5571bec4ff52773ddc75b1738da9","target":{"file":"sql/table.cc","function":"mysql57_calculate_null_position"},"deprecated":false,"digest":{"length":743,"function_hash":"85676934499880264601416161311707180166"},"id":"CVE-2026-107821-02b21eac","signature_type":"Function","signature_version":"v1"},{"target":{"function":"TABLE_SHARE::init_from_binary_frm_image","file":"sql/table.cc"},"deprecated":false,"digest":{"length":36251,"function_hash":"82801121302399979878132824021630315459"},"id":"CVE-2026-107821-0f8d0e0f","signature_type":"Function","signature_version":"v1","source":"https://github.com/mariadb/server/commit/3b1c2e58abab5571bec4ff52773ddc75b1738da9"},{"target":{"file":"sql/table.cc","function":"fix_type_pointers"},"deprecated":false,"digest":{"length":892,"function_hash":"338418176691477006438878597160865999730"},"id":"CVE-2026-107821-18583404","signature_type":"Function","signature_version":"v1","source":"https://github.com/mariadb/server/commit/3b1c2e58abab5571bec4ff52773ddc75b1738da9"},{"id":"CVE-2026-107821-1cd3e8db","signature_type":"Function","signature_version":"v1","source":"https://github.com/mariadb/server/commit/83e909fc2a0dbc394b4b683fb3fa2d7dcf26cc5e","target":{"function":"Rows_log_event_fragmenter::fragment","file":"sql/log_event_server.cc"},"deprecated":false,"digest":{"length":1715,"function_hash":"339712868486696881928202886484344029960"}},{"deprecated":false,"digest":{"function_hash":"213402534861431797481623475064042930965","length":4382},"id":"CVE-2026-107821-381a2954","signature_type":"Function","signature_version":"v1","source":"https://github.com/mariadb/server/commit/3b1c2e58abab5571bec4ff52773ddc75b1738da9","target":{"function":"create_key_infos","file":"sql/table.cc"}},{"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["265577632303887446289749120585557906012","90338461107598051749602183626527029076","135974257990159682542061181314070611477","59440921527566409168742990730026725636","871135494022066138858656571240698570","247293449498909397416026347351022219912","179396894775406735805665784479451940140","269443033021460921618747189093528286356","259691733175197008076763079871985256069","102338916828131457031608538914692707050","65381815336936246662830619643818353906","7100122396357284882133944108516856108","161393146120866756988306743699529625075"]},"id":"CVE-2026-107821-6d62851c","signature_type":"Line","signature_version":"v1","source":"https://github.com/mariadb/server/commit/bf9193a939f515e95dd8def1a5468088c91cede6","target":{"file":"sql/item_vectorfunc.cc"}},{"id":"CVE-2026-107821-8557a9e4","signature_type":"Line","signature_version":"v1","source":"https://github.com/mariadb/server/commit/3b1c2e58abab5571bec4ff52773ddc75b1738da9","target":{"file":"sql/table.cc"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["47920626166564915707844108170553976783","57650215753729557298652743605907648451","225809051061404070915381110455764440776","329599490030046015987457036067652106022","193319660483070688359067603731676003494","35622306923076348838281878440148078265","203814631487698515612775719839566580770","20430701255949821678403902881508784752","108822724051117439816140179556695960277","252710795875484927025242901151726201454","60509711634924858389931357711604569829","111976337997444070987757836978957439530","217924766426042106655051072213055501146","217734671666989279310266486004020255549","165793228874504239350047061390683139091","173926835296080214790079094795002732331","124150931242845765664770822028053239015","217897647726549134735036968422612797714","249816654103949037232494683772654347813","273639606732627959764674262759725186825","66214329855802435584232323253873310932","315855020901247523249227915417143418527","181363402731523028042725285378534240400","156459243938515428161827965002670856096","46957592358107355424593942356612435088","289003428063457768165225349285919414583","215340652513247402175651994830429604790","266391956627514580190748772808271234529","245030019918293354095167811210924106475","37668838200630339403488218154242275777","207536544481733954790939231692370151999","276265123614463995527943967540228781344","191255820059382776458425933432492173463","329979547459370691324710500341560982156","99935831713873286433107733642990160918","280498848989922555254174523297260100258","212111216173735803544448374125015305462","136508124913375856298475437832434215918","330727715674617723247185777064465418770","9829723704366416043140041309864416169","291956027271285448872694171931599906930","253124555050745286530495932624719245436","57114816518475014010631048121337757028","232156718642522337025080367427832074340","250115227196368677103636807765144507300","258263892071093590169127926337004136326","316057541348663522596152543543109363301","151704139085500231402456307423773859407","34865993227858291068707613128235319347","100608195931528977946114924182825681373","241260501077511663928784498774526653933","323790681142721322355371184374327951157","285050768946491087692061705598595462361","250138610949584734658184005183912520245","126615029383846306548930111860096983233","227831148539585186124013442740178608430","64303277862951263066453535276973574984","252444634124267644578696406441233708958","125260097882230235897154141736219887120","83415268248476385440764954701624744057","111068391043389285503642546941773919033","24325014432977582242073132680228591702","152333992199692693432900713966568169331","166786863628273811179391926762909351201","77961708057630719847546926247132570350","46790822979435331387251122946421087744","160476066107976868157830983289696105089","63661485043265188537218435702660301476","196913870038437546294670547661924446398","102535844418965070322885866299748069794","99126703657444332130424920567340275367","325354178101103049992325167892378799835","138950990183746950752292654981277993171","60546558158166226592230001388014505843","198106492348147784756316366812739501183","162461888182177187484044691483432601262","334028481016881908171149650743047372108","27503157118486121968954311501573962690","62810256518856599067595196551768453395","266028535541025047590220217536398135102","286197980224401279137726318673389010381","286970006793084927312100411257875112683","198163873432384181944004979869079386818","282045108676430846000947132922884454592","211083546695665301235956123903590135090","145881208698573830182369096787787050771","33502979001879773726527012789418608607","329917702477661178773197836034233954828","201179769969020569874407701786317147689","331795995756028679907368817716446746654","98086207172201893768496690031373101198","107927917864074385135929360236975295369","22257218930520138506130840779222024858","266800439367647959034124511974441477013","42858855567202202764451421231209485061","61206600496920825346916454970212094809","164650503943347300229986361335730272056","240109660535340178630782455452899886909","285251407206710014772297831993566445960","266864156883082470717025081616966534658","117821039734152784061132682697585200262","78736565804730449995233310295336093585","94490142402566682442552359521534975050","154431601115720577168609958797186324197","106109335871358716627417199286489014191","188643920355965778028127630526583439857","337265071749951474109531218425288787542","210556729931617222831694249738278968202","198927933857576667168765058370841113203","266638978014490309876562705588586851669","183828463190277264632133947936585093493","86418469795573230197891429961734390842","308067537378289931955296983152581266833","278769536131183903109090487273511999669","30512401852697940564563447474273667498","66432238535878991020836041849089429228","308686295651036217092158695108423277393","92390567130675452087234587289929440147","276100125935897714589952719957838653674","326474391909508774569938428833746281553","79254397404682713486085552226184288689","241777779855434738989214669324695306892","256468376819176870464911353864909475485","94431396268200018992295110873467512454","247643285568336753941227792646684140381","82042691172642668942289378373244062130","111728105746253962826678337750589639484","177769764167984736073757278113927952920","113747906190842097520776326310430654898","133363525334858595699273288369912095586","18706432842324807646871370362330540752","99512207185159297714327620894794493742","237699270187219304987768713170079596557","64286475938185527060133822188016314420","109931064855881032864112300495610321199","210945830382036201304241862006228192628","153334227148678201619631687451208542490","328045658735718164373331478091964967477","313260637568555636795500994208115991782","86483759542418029836978264678397742113","79116618312507289517782658134076089227","171138769565019052866564512343788430848","89135095225873052322172554603301283716","101066078394958450664891766716332369010","54226703391799717072687083564430021478","268224342465559874799636167186769592936","50272590705649515447399560075482709091","28064038317311593922517036128557086076","143044362687111140975258659381625366189","12984081484208620612736333897035379139","195330295399697890533927898409000763257","130921001538375341412371692065538636174","10603349623297612146443498053861202911","202400677928611635088212270208596592046","185669603723607978582694557777743416266","214702942390596159428381246918905598204","179510895416611841241916437811736763464","271694642017271774812540885236019587389","226231396841680225690795407752545092064","6872883331479672228684329468599450278","119432270245959497932228801349731776975","135715979629469434379441833587893621872","110538509026094736189061594204587513563","272797725656857612473728918234409565260","192943199869802597279301457719971063954","21752897273309788440308554200722790916","147212649824525913456888148341036107720","217297195825942812026979938182033838814","167620198006533953672081876452697995443","48052990745143719889542909969311444888","285592443442146971732124708672602712387","271732494860671087321895487778943999263","149365537118734880382165530162338358771","22736045745370602563672248097024315806","106553298443918992138319960600670811619","186581123098647987638588820525059302212","308795727324023880859176970173446082854","222773692371921670508223070929759796542","9433297535515778704350190748506540706","79266908201326817162343066532846171678","281805629554070463777294630388145526250","23718152588979487055863651781785858565","92448127404728281454355087256744479353","190366322846178434287983795784251682973","273280438789351590234120235185431462689","94532614905862558320912230567855371002","160084494217174741785486426088244101424","232964383609351974653165630123140168969","91233867200308378339267076673731689459","147856544224703688024508528991541004611","122394116883978366157719038646897937475","177442148244067130359758793730230431862","271215668538068296473788452292973308352","153013429866981535157404497884527838781","193942817637088005618662047605944810971","259034189735616909544866028235806752561","89961897874434917106422493426662593749","114291869463019632719817252237430865559","330803815039592360900954992592866360381","238590313866878854289972554921207701588","120089998951004730755123702743018348027","262251774245078195738586457067153096105","215345454667883020344551857752450190531","257866915810018103854456452787250210715","12892679525510366950052515815375431902","288314229257554202140108426163847082354","153863725375209641462939985417318406532","22442237858430483997386153090614912169","329673681004148588465419482637101524903","89178284510322076587293340506750192868","215812530200173161477455478134851162237","334973286924301885818533576542171500791","300363938938394140429465916638659824489","236157433255326792250125611130060682435","97092305787334589365847643090046809251","98983931215087708401575363762293727169","13012740567980945294784603672852162966","145576556003088075764130749458483892113","148716150531860900120486999271541184335","116219721288140074531523938670109706384","117157602344210574688497509179046324919","318678295779951336210274694477113231915","298970368050343599610954827163987609233","52967257833971690443307559281059304381","103525305055169760979312044859602221263","70096964522201787437761533459951004418","204008550138029121275747718326197829340","254105904453003291927655303823508590655","320073846085226551672990132634391928841","207506212071209470350865008930565289747","284233392724085004357154050226566667933","227199434438924522616938052083085715774","326059804283612542720870376992909167965","268532987494094125982728156877802289354","139351001401713106689858052967748092304","55314344695560709654170133603814999745","87265567844252006987330775739866835703","234060176166982920421882661035477750833","190174284430323636376636031392900855049","213281422418844949617895981513515303966","113319915257879310189859647177057075828","232798553559626292160183967221925180548","13078653266590214069683083701399393337","261649467252164910634475585864337762778","191252258764358631487166391587571388201","244209487274899263135518382269500833014","301621501897516898603245015350352054557","61464613730785224590083263609174609515","332880954583734203389001808482654477531","296696381379930300072316420129990884107","72438724835601602347029171956060243185","234937906613993309938153813122685985509","305487688978903219099987527565499611873","232118716673578318188973493512851849923","256061543427852088323646595828899592316","34212110187111330063940424880234422659","220676607240153265078885174555557648947","80424426424409789227526517580422498004","172872587689778263166252984616400306081","206080062868382482169213215492824168215","260583995148806489067683432885108762879","283572326318496532712224093088184069164","334136780359279678813316761295859812144","35561755448136761224396848453136525943","19396769513815346388774619779697393492","8003078916882554976264076817246163783","265771204733260914094595547566885235718","258317462214870577142944484439338605800","3602597199546911571618624265588483692","31159972866976672504231479919959150631","228950797240722266300025018483925159578","293676915528787409420174664436990316150","32502110225224070435920156032970203012","192966921617423522537325754254072385630","21614917312422767682393702358459303672","104341854978351922567480055252739733766","86487414353506593429254117738345625459","24861775919159161879175385026862170539","38376576925870097386599125863789763827","289835029767527503629957931747142110654","197698358461703699480241010268463335746","328057992145218445718269413905989593674","154508355247439809558812653753238968809","142520917764134846458263457819830097021","190381486436019279325840948238877507776","128327245812144515976506181080490768082","75407180318704451699303769443305508093","204104360309238309677356920741191334574","216672026069995216683305345328879388112","283547243460214344190460309889384816737","206841859893941800130745778702166899107","292581586898788045579197746424247454206","73835596629554064866601910803180136075","131699735111764835492800531948954488677","190793629242997270016645052996827993668","69550152385949472593670552606463724523","247212470847985409200858861281297443931","169266974796689895060413430835367774865","238207301567956415084411604841838366720","166784208229654748277066250654943127019","26415462408762896317024074822543989265","295061017862423459284181932087632931603","192906121576031241999457975565875376173","172689191746539311401958076697756626077","287986494631107967662969141947780574649","99412790743128044165786196906515607536","224046730109237414648496628334168982414","115222589816603518846820736754528421346","320996143298549011093760646171186647926","76560848796519964013190462278591061583"]}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/mariadb/server/commit/210ab6edf47fa73f3b77e974ed2e9357ccdd051c","target":{"function":"sp_revoke_privileges","file":"sql/sql_acl.cc"},"deprecated":false,"digest":{"function_hash":"19396654230727680862231874232577326830","length":1414},"id":"CVE-2026-107821-96fb114a"},{"signature_version":"v1","source":"https://github.com/mariadb/server/commit/bf9193a939f515e95dd8def1a5468088c91cede6","target":{"file":"sql/item_vectorfunc.cc","function":"Item_func_vec_fromtext::fix_length_and_dec"},"deprecated":false,"digest":{"function_hash":"73617688475456381632237133958511949829","length":361},"id":"CVE-2026-107821-c0933a1f","signature_type":"Function"},{"signature_version":"v1","source":"https://github.com/mariadb/server/commit/83e909fc2a0dbc394b4b683fb3fa2d7dcf26cc5e","target":{"file":"sql/log_event_server.cc"},"deprecated":false,"digest":{"line_hashes":["171922335289695664967320282302097012127","314879264303882873216162120692739820747","296657960952465744719770094395708912555","28908880241426286725700820784852115102"],"threshold":0.9},"id":"CVE-2026-107821-e432b228","signature_type":"Line"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/mariadb/server/commit/210ab6edf47fa73f3b77e974ed2e9357ccdd051c","target":{"file":"sql/sql_acl.cc"},"deprecated":false,"digest":{"line_hashes":["183641122820527899892205997373469390336","12095135203163139841028791777804307677","261887274333923489567884393156281229573","19596961056601881646204718953590518429","25158190267319178375799434564910426458","79868031186840623159971036872671971261","200778640584501115234958299261030732588","131021480572983927965383857652169015703","259210579588990591926922975771411684670","308293174102341777206582901688760031968","89478837310948837990084826679872794784","338867660209294619394468737325384824268","65149555481557669088217935797404683315","105820217938288583399134742620391383975","267805393157920367530703819131918882708","38039493077906535068223160253483389044","155248208230518966475406644089911097304","209055380163172280650138201893193615240","272836316798595100180885698601052815062","139632117011298755459574139848637089730","112587756624072824044503235660869015796","209449771227581042596611529590064743564","56162312170597687179668831370098686864","315300952757613979287910862404135586893","124631588903503696531604192284802908081","198447588607325890124688444202645428954","277625244959498228703902376649148264741","330117756961362545716991630961872097576","261593920518145687707482140334066129492","310029719624151742354329969579957852433","127355466400457567574110878344968834572","234782324348854453769025645027188821308","4933798797732149183640097703596172566","78315220821823291688255278082772905562","283495978258419445643401192492072153310","289680889044596507883491876189615178669","77013134991366103256989980017263461542"],"threshold":0.9},"id":"CVE-2026-107821-ebba965d"}],"vanir_signatures_modified":"2026-10-22T16:09:13Z"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H"}]}