CVE-2022-27376

HIGH

MariaDB 10.3.0-10.3.34 - Use-After-Free in Item_args::walk_arg

Title source: llm

Description

MariaDB Server v10.6.5 and below was discovered to contain an use-after-free in the component Item_args::walk_arg, which is exploited via specially crafted SQL statements.

References (3)

Core 3

Core References

Exploit, Issue Tracking, Vendor Advisory x_refsource_misc

https://jira.mariadb.org/browse/MDEV-26354

Third Party Advisory x_refsource_confirm

https://security.netapp.com/advisory/ntap-20220519-0007/

Mailing List, Third Party Advisory mailing-list x_refsource_mlist

https://lists.debian.org/debian-lts-announce/2022/09/msg00023.html

Scores

CVSS v3 7.5

EPSS 0.0032

EPSS Percentile 55.5%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Details

CWE

CWE-416

Status published

Products (2)

debian/debian_linux 10.0

mariadb/mariadb 10.3.0 - 10.3.35

Published Apr 12, 2022

Tracked Since Feb 18, 2026