🔺Severity: null
👽 Reporter: lukas kupczyk
⭐️ Reputation: 128
🛠 State: resolved
💼 Team: MariaDB
💵 Bounty: null
🕐 Submitted: 2026-06-04
⏰ Disclosed: 2026-09-15 09:39:00
📝 Summary: A stack-based buffer overflow was discovered in the MariaDB Server's
Charset collation map st::insert or replace() function. The function copied user-supplied charset and collation identifiers into fixed-size stack buffers using strmake() with the attacker-controlled token length as the size bound instead of the destination buffer size. This could have been leveraged by an authenticated user to crash the entire mariadbd process with a single SQL statement.📂 Report JSON File: 3782405
@hackeronereports