Hackerone Reports on Telegram: “🎯 New Report #3897914: Out-of-bounds read in Ma…”

🎯 New Report #3897914: Out-of-bounds read in MariaDB .frm parsing enables RCE via vtable hijacking
🔺Severity: High
👽 Reporter: pinebudweiser
⭐️ Reputation: 107
🛠 State: resolved
💼 Team: MariaDB
💵 Bounty: null
🕐 Submitted: 2026-07-29
⏰ Disclosed: 2026-09-08 08:19:08
📝 Summary: A vulnerability was discovered in MariaDB where the key part->fieldnr value parsed from a crafted .frm file was not validated before being used as an index into the share->field[] array. This resulted in an out-of-bounds read, allowing an attacker to hijack the C virtual method call and achieve arbitrary code execution within the context of the MariaDB server process. The vulnerability was successfully reproduced on MariaDB versions 10.4.18, 11.8.8, 12.3.2, and 13.1.0 Preview.
📂 Report JSON File: 3897914
@hackeronereports