MariaDB Low-Privilege Remote Code Execution Chain: Full Details and PoC Exploit Code Publicly Disclosed
Do Son 
TL;DR
Researchers at V12 Security published a MariaDB remote code execution chain. It runs commands as the mariadbd process from a low-privilege database account. Both the technical details and proof-of-concept exploit code are now public.
Why it matters
MariaDB is one of the most widely deployed open-source databases. This attack needs no FILE, SUPER, or admin rights. It uses only the normal TCP query interface. As a result, any authenticated user becomes a serious threat.
How the attack works
The exploit chains two memory-safety bugs. First, an out-of-bounds read in the ST_Area function leaks heap and PIE addresses. A crafted MULTIPOLYGON makes the function read past its buffer.
Next, a use-after-free in the SYS_REFCURSOR cursor array gives control of program flow. A FETCH then follows a stale pointer into attacker-reclaimed memory. That step drives the MariaDB remote code execution to a shell command.
The researchers also describe a separate one-line privilege escalation primitive. It abuses an empty authentication clause in a GRANT statement. This report withholds working payloads on purpose.
Public disclosure and exploit code
Full write-ups and proof-of-concept code sit in two public repositories. One is the V12 Security MariaDB PoC. Another is a MariaDB 13 RCE lab. The upstream tracking issue is MDEV-40328.
Exploitation status
Public proof-of-concept exploit code exists for this low-privilege RCE. However, no in-the-wild exploitation has been confirmed so far.
Affected versions
The chain affects MariaDB 10.6, 10.11, 11.4, 11.8, and 12.3.
Patch and mitigation
Upgrade without delay. Fixed builds include 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2. Until you patch, tighten database account access and restrict network exposure.
Support Our Threat Intelligence
If you find our CVE report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
