Vulnerability overview

Five CVEs with five scores invite a sort-and-start-at-the-top habit. CSA Singapore alert AL-2026-144 lists CVE-2026-107815 at 8.5, CVE-2026-107814 and CVE-2026-107818 at 8.4, CVE-2026-107821 at 8.0 and CVE-2026-107823 at 7.2, all under CVSS v3.1. Sorting by those numbers produces a queue that front-loads CONNECT and defers the privilege-escalation flaw. Whether that order matches your risk depends entirely on who holds which grant.

Mechanism and exploitation conditions

The score differences here are small, and they encode assumptions about access rather than severity of outcome. CVE-2026-107815 needs an authenticated user with CONNECT access and yields a crash with potential code execution. CVE-2026-107814 and CVE-2026-107818 need FILE and yield file writes that become execution at a later trigger.

CVE-2026-107823 needs CREATE USER plus CREATE VIEW WITH GRANT OPTION and yields privilege escalation inside the database. CVE-2026-107821 needs a crafted FRM file in the data directory and yields an out-of-bounds read or write.

Read that list as a set of required capabilities and the ordering flips for many estates. A reporting platform that granted FILE widely for CSV exports is more exposed to the 8.4 pair than to the 8.5 engine flaw. A multi-tenant instance where application accounts were given CREATE USER in a development push is more exposed to the 7.2 flaw than to anything else in the release.

Impact

The outcomes differ in kind. File-write flaws end in host-level compromise under the service account. The FRM flaw can end in memory corruption inside the server. The CONNECT flaw can do the same. The username-metadata flaw ends in a wider database role, which is often the stepping stone that makes the others easier.

Prioritising by score alone risks patching the least reachable flaw first and declaring progress. The remaining exposure is unchanged on the hosts that actually matter.

Affected products and scope

All five apply to 10.6.1 to 10.6.27, 10.11.1 to 10.11.18, 11.4.1 to 11.4.12, 11.8.1 to 11.8.8, 12.3.1 to 12.3.2 and 13.0.1. Since the ranges are identical, per-flaw scoping has to come from configuration, not from which branches are affected.

Exposure context

A ZoomEye query for app="MariaDB" returns 5111720 assets that identify as MariaDB. Use it to bound how much of the internet runs the software family, then set it aside: the prioritisation decision needs grant data that no external scan can see.

ZoomEye search: https://www.zoomeye.ai/searchResult?q=YXBwPSJNYXJpYURCIg%3D%3D

Remediation and mitigations

Score each host, not each CVE. For every instance, record the build, then record whether FILE is granted, whether CONNECT is available, and which accounts hold CREATE USER. Multiply the flaw list by that configuration and you get a ranked list that reflects reachability.

Where the analysis is inconclusive, patch the whole set in one branch-level change. Six branches with five flaws is still six change records, and combining them costs less than sequencing five separate windows.

After patching, repeat the configuration scoring to confirm the risky grants are gone. A host that is patched but still grants FILE broadly has reduced exposure, not eliminated exposure.

References