MariaDB v10.5 was discovered to contain a remote code execution (RCE) vulnerability via UDF Code in a Shared Object File, followed by a "create function" statement. NOTE: this is disputed by the MariaDB Foundation because no privilege boundary is crossed.
References
| Link | Resource |
|---|---|
| https://github.com/Ant1sec-ops/CVE-2023-26785 | Exploit Third Party Advisory |
| https://seclists.org/fulldisclosure/2012/Dec/39 | Mailing List |
Configurations
History
10 Jul 2025, 19:06
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Mariadb
Mariadb mariadb |
|
| Summary |
|
|
| References | () https://github.com/Ant1sec-ops/CVE-2023-26785 - Exploit, Third Party Advisory | |
| References | () https://seclists.org/fulldisclosure/2012/Dec/39 - Mailing List | |
| CPE | cpe:2.3:a:mariadb:mariadb:10.5.0:*:*:*:*:*:*:* |
21 Oct 2024, 00:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
|
| Summary | (en) MariaDB v10.5 was discovered to contain a remote code execution (RCE) vulnerability via UDF Code in a Shared Object File, followed by a "create function" statement. NOTE: this is disputed by the MariaDB Foundation because no privilege boundary is crossed. |
18 Oct 2024, 19:35
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-94 | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 9.8 |
17 Oct 2024, 22:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2024-10-17 22:15
Updated : 2025-07-10 19:06
NVD link : CVE-2023-26785
Mitre link : CVE-2023-26785
CVE.ORG link : CVE-2023-26785
JSON object : View
Products Affected
mariadb
- mariadb
CWE
CWE-94
Improper Control of Generation of Code ('Code Injection')