🎯 New Report #3871977: Connector/ODBC: malicious server's long version string wraps size t PrefixLen via negative snprintf return, causing heap out-of-bounds write
🔺Severity: Medium
👽 Reporter: fg0x0
⭐️ Reputation: 808
🛠 State: resolved
💼 Team: MariaDB
💵 Bounty: null
🕐 Submitted: 2026-07-18
⏰ Disclosed: 2026-10-12 09:27:31
📝 Summary: A memory corruption vulnerability was discovered in the MariaDB Connector/ODBC driver. When a malicious server sent a handshake with an excessively long version string exceeding approximately 500 bytes, a custom snprintf function returned a negative value. This negative value was added to an unsigned integer, causing integer wraparound. The corrupted value was subsequently used as an offset into a fixed-size buffer, resulting in out-of-bounds heap writes. The vulnerability was triggered unauthenticated and remotely when an application allocated a statement on a poisoned connection. The flaw was confirmed to cause heap buffer overflow with address sanitizer testing on the driver built from source.
📂 Report JSON File: 3871977
@hackeronereports