medium CVSS 6

CVE-2026-22027·MariaDB vulnerability

CryptoLib provides a software-only solution using the CCSDS Space Data Link Security Protocol - Extended Procedures (SDLS-EP) to secure communications between a spacecraft running the core Flight System (cFS) and a ground station. Prior to version 1.4.3, the convert_hexstring_to_byte_array() function in the MariaDB SA interface writes decoded bytes into a caller-provided buffer without any capacity check. When importing SA fields from the database (e.g., IV, ARSN, ABM), a malformed or oversized hex string in the database can overflow the destination buffer, corrupting adjacent heap memory. This issue has been patched in version 1.4.3.

Severity
medium
Software
MariaDB
Fixed in
1.4.3
Published
2026-01-10

Affected versions

Until: 1.4.3

Fixed in: 1.4.3

How to fix this CVE

Update MariaDB to version 1.4.3 or later to patch a buffer overflow vulnerability in the hex string conversion function used when loading security parameters from the database. This flaw could allow authenticated users with database write access to corrupt heap memory by inserting malformed hex strings into SA fields. Promptly apply the security update and restart the MariaDB service to mitigate the risk.

sudo dnf update mariadb-server

Defensia detects this vulnerability

How to check if you are affected

  1. Run `mariadb --version` or `mysql --version` to check the installed MariaDB version; confirm it is 1.4.3 or later
  2. Query the MariaDB error log for signs of memory corruption: `grep -i 'segmentation\|fault\|core dumped' /var/log/mysql/error.log`
  3. Check for unexpected database crashes or restarts around the time frame when untrusted hex strings may have been inserted: `journalctl -u mariadb -n 100 --no-pager`
  4. Verify the patch was applied by checking the file modification times: `stat /usr/sbin/mariadbd | grep Modify` and confirm it matches the update timestamp

FAQ

What is CVE-2026-22027?

CVE-2026-22027 is a buffer overflow vulnerability in MariaDB's hex string conversion function that processes security parameters (IV, ARSN, ABM) loaded from the database. An attacker with database write privileges can craft oversized hex strings to overflow a fixed-size buffer and corrupt adjacent heap memory.

Is CVE-2026-22027 being actively exploited?

No, CVE-2026-22027 is not currently listed on CISA's KEV catalog and no public exploits are available. However, the vulnerability should still be patched promptly since it requires only database access to trigger.

What versions of MariaDB are affected by CVE-2026-22027?

All versions of MariaDB prior to 1.4.3 are vulnerable. The exact earliest affected version is not specified in the advisory, so it is safest to assume all versions before 1.4.3 contain the flaw.

How do I check if my server is vulnerable to CVE-2026-22027?

Run `mariadb --version` and verify the output shows version 1.4.3 or later. If the version is below 1.4.3, your installation is vulnerable and requires immediate patching.

Does Defensia detect CVE-2026-22027?

Yes — Defensia's CVE advisory scanner compares installed package versions against the NVD database. If MariaDB is installed on a monitored server, CVE-2026-22027 will appear in your dashboard with remediation steps.

Related MariaDB CVEs

CVE-2026-49261CVSS 10MariaDB server is a community developed fork of MySQL server. Versions 10.6.1 through 10.6.26, 10.11.1 through 10.11.17, 11.4.1 through 11.4.11, 11.8.1 through 11.8.7, and 12.3.1 with `wsrep_notify_cmd` enabled would execute shell commands embedded in the name of the joiner node. This is fixed in 10.6.27, 10.11.18, 11.4.12, 11.8.8, and 12.3.2. As a workaround, anyone who cannot upgrade now should disable `wsrep_notify_cmd`.
CVE-2026-44170CVSS 9.8MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.26, 10.11.1 to before 10.11.17, 11.4.1 to before 11.4.11, 11.8.1 to before 11.8.7, and 12.3.1, MariaDB on WIndows with installed CONNECT engine and enabled REST support interpolated table HTTP attribute into the curl command line without proper sanitizing. This allows the user to execute shell commands on the server. This issue has been patched in versions 10.6.26, 10.11.17, 11.4.11, 11.8.7, and 12.3.2.
CVE-2026-22730CVSS 8.8A critical SQL injection vulnerability in Spring AI's MariaDBFilterExpressionConverter allows attackers to bypass metadata-based access controls and execute arbitrary SQL commands. The vulnerability exists due to missing input sanitization.
CVE-2026-107815CVSS 8.5MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the CONNECT engine's DOS table type used an incorrect boundary check that permitted a one-byte null write beyond a stack buffer at an attacker-controlled offset. An authenticated user able to use the CONNECT engine could cause a crash and potentially remote code execution. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.
CVE-2026-32710CVSS 8.5MariaDB server is a community developed fork of MySQL server. An authenticated user can crash MariaDB versions 11.4 before 11.4.10 and 11.8 before 11.8.6 via a bug in JSON_SCHEMA_VALID() function. Under certain conditions it might be possible to turn the crash into a remote code execution. These conditions require tight control over memory layout which is generally only attainable in a lab environment. This issue is fixed in MariaDB 11.4.10, MariaDB 11.8.6, and MariaDB 12.2.2.

References

Track CVEs across your fleet automatically

Defensia scans your Linux servers and tells you exactly which ones are running vulnerable versions — including CVE-2026-22027. Free for 1 server.

Get started free