🎯 New Report #3896671: Connector/C Out-of-bounds read in `unpack fields()` from short metadata field
🔺Severity: null
👽 Reporter: mschorm
⭐️ Reputation: 128
🛠 State: resolved
💼 Team: MariaDB
💵 Bounty: null
🕐 Submitted: 2026-07-28
⏰ Disclosed: 2026-09-30 10:29:05
📝 Summary: A buffer over-read vulnerability was identified in the metadata field parsing function within the database connector library. The function processed fixed-header metadata without validating that the field data contained the required minimum length of 12 bytes. A malicious or compromised server could send truncated metadata fields and trigger out-of-bounds memory reads in the client process. This affected all versions through the current release branch and could result in information disclosure or client process crashes. The vulnerability required a malicious server connection or network position to exploit.
📂 Report JSON File: 3896671
@hackeronereports