🎯 New Report #3872248: Connector/C : heap out-of-bounds read when malicious server field length exceeds declared column length in binary result path
🔺Severity: Medium
👽 Reporter: fg0x0
⭐️ Reputation: 808
🛠 State: resolved
💼 Team: MariaDB
💵 Bounty: null
🕐 Submitted: 2026-07-18
⏰ Disclosed: 2026-10-12 09:26:55
📝 Summary: A heap out-of-bounds read vulnerability was identified in the connector library when processing binary result sets. The vulnerability occurred because the buffer for each result column was sized based on the server-declared column length, but then the actual field length reported by the server in row packets was read from that buffer without proper bounds checking. A malicious server could declare a small column length while sending a larger field value, causing adjacent process memory to be read and leaked into application-visible column values or triggering a process crash. The vulnerability was reachable through the binary protocol path when server-side prepared statements were used or when stored procedure calls were executed. Information disclosure of adjacent heap memory and denial of service were possible impacts.
📂 Report JSON File: 3872248
@hackeronereports