CVE-2026-92262
CVE-2026-92262 · MariaDB: Numerous issues caused by historical #mysql50# tablename encoding bypass.
This page contains facts from public vulnerability sources. Check the original advisory before updating.
MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the #mysql50# bypass prefix is affected because it allows the #mysql50# prefix to bypass normal table-name filesystem encoding. An attacker can trigger the issue with a table name using the #mysql50# prefix, then use a #mysql50# table name to access files under their legacy unencoded name and cause crashes, data corruption, data exfiltration, or remote code execution. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.
CVSS 9.9 · Critical · EPSS 0.7% · Public exploit · Fix available
- Published
- Updated
Affected products and versions
server
- Versions
- >= 10.6.1, < 10.6.28: Affected
- >= 10.11.1, < 10.11.19: Affected
- >= 11.4.1, < 11.4.13: Affected
- >= 11.8.1, < 11.8.9: Affected
- >= 12.3.1, < 12.3.3: Affected
- >= 13.0.1, < 13.0.2: Affected
No fix published
mariadb Debian:12
- Versions
- 1:10.11.11-0+deb12u1
- 1:10.11.13-0+deb12u1
- 1:10.11.14-0+deb12u1
- 1:10.11.14-0+deb12u2
- 1:10.11.18-0+deb12u1
- 1:10.11.19-0+deb12u1
- 1:10.11.3-1
- 1:10.11.3-2~exp1
- 1:10.11.4-1
- 1:10.11.4-1~deb12u1
- 1:10.11.5-1
- 1:10.11.5-2
- 1:10.11.5-3
- 1:10.11.6-0+deb12u1
- 1:10.11.6-1
- 1:10.11.6-2
- 1:10.11.6-2.1~exp1
- 1:10.11.7-1
- 1:10.11.7-2
- 1:10.11.7-3
- 1:10.11.7-4
- 1:10.11.8-1
- 1:10.11.9-0+deb12u1
- 1:11.4.2-1
- 1:11.4.2-2
- 1:11.4.2-3
- 1:11.4.2-4
- 1:11.4.3-1
- 1:11.4.4-1
- 1:11.4.4-2
- 1:11.4.4-3
- 1:11.4.5-1
- 1:11.4.5-2~exp1
- 1:11.8.1-1
- 1:11.8.1-2
- 1:11.8.1-3
- 1:11.8.1-4
- 1:11.8.1-5
- 1:11.8.2-1
- 1:11.8.3-1
- 1:11.8.5-1
- 1:11.8.5-2
- 1:11.8.5-3
- 1:11.8.5-3~exp1
- 1:11.8.5-3~exp2
- 1:11.8.5-3~exp3
- 1:11.8.5-4
- 1:11.8.6-1
- 1:11.8.6-2
- 1:11.8.6-3
- 1:11.8.6-4
- 1:11.8.6-5
- 1:11.8.6-6
- 1:11.8.8-1
- 1:11.8.9+ds-1
- 1:11.8.9+ds-2
- 1:11.8.9+ds-3
- 1:11.8.9+ds-4
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
mariadb Debian:13
- Versions
- 1:11.8.2-1
- 1:11.8.3-0+deb13u1
- 1:11.8.3-1
- 1:11.8.5-1
- 1:11.8.5-2
- 1:11.8.5-3
- 1:11.8.5-3~exp1
- 1:11.8.5-3~exp2
- 1:11.8.5-3~exp3
- 1:11.8.5-4
- 1:11.8.6-0+deb13u1
- 1:11.8.6-1
- 1:11.8.6-2
- 1:11.8.6-3
- 1:11.8.6-4
- 1:11.8.6-5
- 1:11.8.6-6
- 1:11.8.8-0+deb13u1
- 1:11.8.8-1
- 1:11.8.9+ds-1
- 1:11.8.9+ds-2
- 1:11.8.9+ds-3
- 1:11.8.9+ds-4
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
mariadb Debian:14
- Versions
- 1:11.8.2-1
- 1:11.8.3-1
- 1:11.8.5-1
- 1:11.8.5-2
- 1:11.8.5-3
- 1:11.8.5-3~exp1
- 1:11.8.5-3~exp2
- 1:11.8.5-3~exp3
- 1:11.8.5-4
- 1:11.8.6-1
- 1:11.8.6-2
- 1:11.8.6-3
- 1:11.8.6-4
- 1:11.8.6-5
- 1:11.8.6-6
- 1:11.8.8-1
- Affected ranges
- ECOSYSTEM: < 1:11.8.9+ds-1
Update to 1:11.8.9+ds-1
mariadb-10.0 Ubuntu:16.04:LTS
- Versions
- 10.0.20-0ubuntu0.15.04.1
- 10.0.22-0ubuntu1
- 10.0.23-1
- 10.0.23-2
- 10.0.24-7
- 10.0.25-0ubuntu0.16.04.1
- 10.0.27-0ubuntu0.16.04.1
- 10.0.28-0ubuntu0.16.04.1
- 10.0.29-0ubuntu0.16.04.1
- 10.0.31-0ubuntu0.16.04.2
- 10.0.33-0ubuntu0.16.04.1
- 10.0.34-0ubuntu0.16.04.1
- 10.0.36-0ubuntu0.16.04.1
- 10.0.38-0ubuntu0.16.04.1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
mariadb-10.1 Ubuntu:18.04:LTS
- Versions
- 10.1.25-1
- 1:10.1.29-6
- 1:10.1.34-0ubuntu0.18.04.1
- 1:10.1.38-0ubuntu0.18.04.1
- 1:10.1.38-0ubuntu0.18.04.2
- 1:10.1.40-0ubuntu0.18.04.1
- 1:10.1.41-0ubuntu0.18.04.1
- 1:10.1.43-0ubuntu0.18.04.1
- 1:10.1.44-0ubuntu0.18.04.1
- 1:10.1.47-0ubuntu0.18.04.1
- 1:10.1.48-0ubuntu0.18.04.1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
mariadb-10.3 Ubuntu:20.04:LTS
- Versions
- 1:10.3.17-1
- 1:10.3.18-1
- 1:10.3.19-1
- 1:10.3.21-2
- 1:10.3.22-1
- 1:10.3.22-1ubuntu1
- 1:10.3.25-0ubuntu0.20.04.1
- 1:10.3.29-0ubuntu0.20.04.1
- 1:10.3.30-0ubuntu0.20.04.1
- 1:10.3.31-0ubuntu0.20.04.1
- 1:10.3.32-0ubuntu0.20.04.1
- 1:10.3.34-0ubuntu0.20.04.1
- 1:10.3.37-0ubuntu0.20.04.1
- 1:10.3.38-0ubuntu0.20.04.1
- 1:10.3.39-0ubuntu0.20.04.2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
mariadb-10.6 Ubuntu:22.04:LTS
- Versions
- 1:10.6.7-2ubuntu1
- 1:10.6.7-2ubuntu1.1
- 1:10.6.11-0ubuntu0.22.04.1
- 1:10.6.12-0ubuntu0.22.04.1
- 1:10.6.16-0ubuntu0.22.04.1
- 1:10.6.18-0ubuntu0.22.04.1
- 1:10.6.21-0ubuntu0.22.04.2
- 1:10.6.22-0ubuntu0.22.04.1
- 1:10.6.23-0ubuntu0.22.04.1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
mariadb Ubuntu:24.04:LTS
- Versions
- 1:10.11.4-1
- 1:10.11.5-3
- 1:10.11.6-1
- 1:10.11.6-2
- 1:10.11.7-2ubuntu1
- 1:10.11.7-2ubuntu2
- 1:10.11.8-0ubuntu0.24.04.1
- 1:10.11.11-0ubuntu0.24.04.2
- 1:10.11.13-0ubuntu0.24.04.1
- 1:10.11.14-0ubuntu0.24.04.1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
mariadb Ubuntu:26.10
- Versions
- 1:11.8.6-5
- 1:11.8.8-1
- 1:11.8.9+ds-4ubuntu2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
mariadb Ubuntu:26.04:LTS
- Versions
- 1:11.8.3-1build1
- 1:11.8.5-1
- 1:11.8.5-2
- 1:11.8.5-3
- 1:11.8.5-4
- 1:11.8.6-1
- 1:11.8.6-3
- 1:11.8.6-4
- 1:11.8.6-5
- 1:11.8.6-5ubuntu0.1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
Original sources
- https://github.com/MariaDB/server/security/advisories/GHSA-65jj-h265-3m7h
- https://github.com/MariaDB/server/commit/574ba66b2d6c5d71db83d416677876e9b592858e
- https://github.com/MariaDB/server/commit/f277eefa424850a8cba5c2371406047f6395e8bb
- https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19
- https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28
- https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13
- https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9
- https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3
- https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2
- https://jira.mariadb.org/browse/MDEV-40362
- https://nvd.nist.gov/vuln/detail/CVE-2026-92262