CVE-2026-32710 is a high severity heap overflow in the MariaDB function JSON_SCHEMA_VALID(), scored CVSS 8.5. An authenticated user can crash the server, and under tight lab conditions the crash might become remote code execution. Upgrade to MariaDB 11.4.10, 11.8.6 or 12.2.2.
What's affected
The GitHub advisory lists these affected releases of MariaDB:
- 11.4.1 through 11.4.9. Fixed in 11.4.10.
- 11.8.1 through 11.8.5. Fixed in 11.8.6.
- 12.1.2. Fixed in 12.2.2.
The NVD record words the first two as 11.4 before 11.4.10 and 11.8 before 11.8.6. The tracking issue is MDEV-38356. The advisory credits Team Xint Code as part of zeroday.cloud.
An attacker needs a valid database account with low privileges, which the CVSS vector reflects as privileges required: low.
How to check if you're exposed
Ask the server for its version:
mariadb --version
Or from an SQL session:
SELECT VERSION();
Compare the result with the list above. Package managed installs can backport fixes without changing the upstream version number, so check your distribution's security notice if your version looks older.
Then count which accounts can run queries. Application accounts, reporting tools and shared logins all count as authenticated users.
What to do now
- Upgrade to 11.4.10, 11.8.6 or 12.2.2 or later, depending on your series.
- Restart the service in a planned window, because the upgrade replaces the server binary.
- Review accounts and remove any you do not need, especially accounts that can connect from outside your network.
- Keep database ports closed to the internet and limit them to application hosts.
- Watch for unexpected server restarts, which could be a sign of someone triggering the crash.
Why it matters
The class is CWE-122, heap based buffer overflow. A function wrote past the end of a memory block it had allocated. The reliable effect is a crash, which is a denial of service for every application using that database.
The advisory is careful about remote code execution. It says turning the crash into code execution needs tight control of memory layout, which is generally only achievable in a lab. That is a fair reason not to panic, and a poor reason to wait, since crash bugs in a shared database are painful on their own.
The record's KEV flag is false, and the advisory does not report exploitation.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Do I need to be an administrator to trigger it?
No. The advisory says an authenticated user can crash the server, and the vector shows low privileges are enough.
Is remote code execution likely?
The advisory says it might be possible under conditions that generally need lab level control over memory layout. Treat the crash as the main risk.
Sources
Last reviewed: 19 October 2026.
