CVE-2026-44172·MariaDB vulnerability
MariaDB server is a community developed fork of MySQL server. In versions 3.3.18 and 3.4.8, an application that was taking non-validated user input, escaping it with mysql_real_escape_string() and sending it to the database using text protocol and big5 character set was vulnerable to SQL injections, even though mysql_real_escape_string() was supposed to prevent them. This issue has been patched in versions 3.3.19 and 3.4.9.
- Severity
- critical
- Software
- MariaDB
- Fixed in
- 1:10.11.18-0+deb12u1
- Published
How likely is exploitation
FIRST's Exploit Prediction Scoring System puts the probability of this CVE being exploited in the next 30 days at 0.40% — higher than 32% of all published CVEs. EPSS is an independent forecast of exploitation, not a severity rating: it says nothing about how much damage a successful attack does, which is what a CVSS score measures.
Read the two together. CVE-2026-44172 scores 9.1 on CVSS, so a successful attack would be serious — but at 0.40%, almost nobody is currently attempting it. That is a different situation from a flaw under mass exploitation, and it is usually the difference between patching on your next maintenance window and patching tonight.
Affected versions
Until: 1:10.11.18-0+deb12u1
Fixed in: 1:10.11.18-0+deb12u1
How to fix this CVE
MariaDB versions up to 10.11.18 contain a character encoding bypass in the mysql_real_escape_string() function that allows SQL injection when using the big5 character set, despite proper escaping. Immediately upgrade MariaDB to version 1:10.11.18-0+deb12u1 or later to apply the security patch that fixes this encoding validation issue.
sudo dnf update mariadb-serverDefensia detects this vulnerability
What an exploitation attempt looks like
Sample log line indicative of exploitation attempts:
SQL queries containing big5-encoded multi-byte sequences with backslash or quote characters (e.g., '0xbf27' followed by SQL keywords) in MariaDB slow query logs or audit logs; look for pattern: [0x81-0xfe][0x40-0xfe] followed by 0x27 or 0x5c in text protocol communicationsWAF mitigation (if patching is not yet possible)
Add this rule to your WAF to block exploitation attempts while you schedule the patch.
Implement WAF rules to block requests with big5 character set encoding in Content-Type headers or URL parameters containing suspicious multi-byte sequences (0xbf27, 0x8e5c patterns); add charset normalization to UTF-8 before database queries; validate character set headers and reject big5 encoding if not explicitly requiredHow to check if you are affected
- Run 'mariadb --version' or 'mysql --version' to check the installed MariaDB version and confirm it is below 10.11.18
- Connect to MariaDB with 'mariadb -u root -p' and execute 'SHOW VARIABLES LIKE "character_set%";' to identify if big5 character set is in use
- Review application code for use of mysql_real_escape_string() function calls, particularly in queries handling user input with big5 encoding
- Run 'dpkg -l | grep mariadb' (Debian/Ubuntu) or 'dnf list installed mariadb-server' (RHEL/CentOS) and verify the package version matches or exceeds the patched version
FAQ
What is CVE-2026-44172?
This vulnerability exploits a flaw in MariaDB's mysql_real_escape_string() function when processing big5 character set encoding, allowing attackers to bypass SQL injection protections through carefully crafted multi-byte character sequences that manipulate quote escaping logic.
Is CVE-2026-44172 being actively exploited?
No, there are currently no reports of active exploitation or publicly available exploits for this vulnerability, though the critical CVSS score of 9.1 warrants immediate patching.
What versions of MariaDB are affected by CVE-2026-44172?
All MariaDB versions up to and including 10.11.18-0+deb12u1 are vulnerable when using the big5 character set. The fix is available in MariaDB 1:10.11.18-0+deb12u1 and later versions.
How do I check if my server is vulnerable to CVE-2026-44172?
Execute 'mariadb --version' to check your version number. If it shows a version below 10.11.18, your installation is vulnerable. Additionally, query 'SHOW VARIABLES WHERE variable_name = "character_set_client";' to confirm if big5 encoding is configured.
Does Defensia detect CVE-2026-44172?
Yes — Defensia's CVE advisory scanner compares installed package versions against the NVD database. If MariaDB is installed on a monitored server, CVE-2026-44172 will appear in your dashboard with remediation steps.
Related MariaDB CVEs
References
Track CVEs across your fleet automatically
Defensia scans your Linux servers and tells you exactly which ones are running vulnerable versions — including CVE-2026-44172. Free for 1 server.
Get started free