🎯 New Report #3910393: Stack Buffer Overflow in MariaDB CONNECT storage engine when reading DOUBLE columns from TABLE TYPE=DOS tables
🔺Severity: null
👽 Reporter: dstesk
⭐️ Reputation: 107
🛠 State: resolved
💼 Team: MariaDB
💵 Bounty: null
🕐 Submitted: 2026-08-02
⏰ Disclosed: 2026-10-12 17:08:52
📝 Summary: A stack buffer overflow vulnerability was identified in the CONNECT storage engine. The vulnerability existed in a function that converts character data to double-precision floating-point values. When reading DOUBLE columns from DOS table files, the function copied data into a 64-byte buffer but wrote a null terminator at an unchecked offset based on the SQL-declared field width rather than the actual copied length. This allowed the null terminator to be written up to 191 bytes beyond the buffer boundary. The issue could be triggered by declaring columns with widths up to 255 characters, causing the database server to crash.
📂 Report JSON File: 3910393
@hackeronereports