CVE-2026-32710·MariaDB vulnerability
MariaDB server is a community developed fork of MySQL server. An authenticated user can crash MariaDB versions 11.4 before 11.4.10 and 11.8 before 11.8.6 via a bug in JSON_SCHEMA_VALID() function. Under certain conditions it might be possible to turn the crash into a remote code execution. These conditions require tight control over memory layout which is generally only attainable in a lab environment. This issue is fixed in MariaDB 11.4.10, MariaDB 11.8.6, and MariaDB 12.2.2.
- Severity
- high
- Software
- MariaDB
- Fixed in
- 11.8.6
- Published
How likely is exploitation
FIRST's Exploit Prediction Scoring System puts the probability of this CVE being exploited in the next 30 days at 0.26% — higher than 49% of all published CVEs. EPSS is an independent forecast of exploitation, not a severity rating: it says nothing about how much damage a successful attack does, which is what a CVSS score measures.
Read the two together. CVE-2026-32710 scores 8.5 on CVSS, so a successful attack would be serious — but at 0.26%, almost nobody is currently attempting it. That is a different situation from a flaw under mass exploitation, and it is usually the difference between patching on your next maintenance window and patching tonight.
Affected versions
From: 11.8.1
Until: 11.8.6
Fixed in: 11.8.6
How to fix this CVE
Upgrade MariaDB to version 11.8.6 or later to patch a denial-of-service vulnerability in the JSON_SCHEMA_VALID() function that affects authenticated users. While remote code execution is theoretically possible under specific memory layout conditions, the primary risk is service disruption. Apply the security update immediately to eliminate crash vectors and ensure database stability.
sudo dnf update mariadb-serverDefensia detects this vulnerability
How to check if you are affected
- Check installed MariaDB version: mysql --version or mariadb --version
- Query the database: SELECT VERSION(); to confirm the running server version matches the installed package
- Review MariaDB error logs for crash dumps: grep -i 'segmentation\|core dump\|signal 11' /var/log/mariadb/mariadb.log
- Verify patch application by checking if version is 11.8.6 or higher: mysql -e 'SELECT VERSION();' | grep -E '11\.(4\.10|8\.6|12\.2)'
- Check for recent JSON_SCHEMA_VALID() function calls in slow query logs: grep -i 'JSON_SCHEMA_VALID' /var/log/mariadb/slow.log
FAQ
What is CVE-2026-32710?
CVE-2026-32710 is a vulnerability in MariaDB's JSON_SCHEMA_VALID() function that allows authenticated users to trigger server crashes. While exploiting it for remote code execution is theoretically possible, it requires precise control over memory layout that is rarely achievable in production environments.
Is CVE-2026-32710 being actively exploited?
No, this CVE is not listed on the CISA KEV catalog and has no publicly available exploits. However, any authenticated database user can trigger the crash, making internal threat actors the primary risk.
What versions of MariaDB are affected by CVE-2026-32710?
MariaDB versions 11.4.0 through 11.4.9, and 11.8.1 through 11.8.5 are vulnerable. MariaDB 11.4.10, 11.8.6, and 12.2.2 contain the fix.
How do I check if my server is vulnerable to CVE-2026-32710?
Run 'SELECT VERSION();' in MariaDB. If the version is between 11.4.0-11.4.9 or 11.8.1-11.8.5, your server is vulnerable. If it shows 11.4.10, 11.8.6, or 12.2.2+, you are patched.
Does Defensia detect CVE-2026-32710?
Yes — Defensia's CVE advisory scanner compares installed package versions against the NVD database. If MariaDB is installed on a monitored server, CVE-2026-32710 will appear in your dashboard with remediation steps.
Related MariaDB CVEs
References
Track CVEs across your fleet automatically
Defensia scans your Linux servers and tells you exactly which ones are running vulnerable versions — including CVE-2026-32710. Free for 1 server.
Get started free