CVE-2026-32710: From a plain SELECT to ALL PRIVILEGES in MariaDB via a heap overflow

An analysis of CVE-2026-32710 in MariaDB 11.4.9 has been published. The vulnerability was initially reported as a simple crash in JSON_SCHEMA_VALID() when processing a long string. However, the researcher demonstrated that the flaw could be exploited to escalate a low-privileged database user's permissions and retain the elevated privileges even after a server restart.

The vulnerability lies in json_get_normalized_string() in sql/json_schema_helper.cc. The function creates a DYNAMIC_STRING with an initial 128-byte buffer but uses strncpy() for string-valued JSON data without first expanding the buffer. As a result, a specially crafted value processed during enum validation triggers a heap-buffer overflow: copying a 194-byte string overwrites 66 bytes beyond the allocated buffer.

Using heap grooming, the researcher arranges several MariaDB user variables adjacent to one another on the heap. The overflow modifies the lower two bytes of the value pointer in a user_var_entry structure, redirecting it to fields belonging to another variable. Subsequent assignments within a single SELECT turn this limited overflow into a write to an attacker-chosen address. The target is Security_context::master_access. After eight bytes of 0xFF are written to this field, the server treats the current session as having all privileges.

With these permissions, the attacker executes GRANT ALL PRIVILEGES ON . ... WITH GRANT OPTION, and MariaDB persists the privilege changes in the mysql.global_priv table. Even if the server process subsequently crashes because of heap corruption, the elevated privileges survive a restart because MariaDB reloads them from the table.

Important PoC limitation: this is not yet a fully self-contained exploit. To determine the address of master_access and the required pointer bytes, the researcher used laboratory access to /proc/1/mem. A real-world attack would require an additional address-disclosure primitive. Therefore, the demonstration does not establish that any user with SELECT privileges can immediately gain administrative access to an arbitrary MariaDB server. The researcher also demonstrated a path to OS command execution via a user-defined function (UDF), but this requires the ability to write to plugin_dir. In the test Docker environment, the directory was deliberately made writable, so RCE cannot be considered a guaranteed outcome of the vulnerability.

The fix replaces the unsafe strncpy() call with dynstr_set(), which expands the buffer before copying. However, the update only fixes the overflow; privileges already granted through exploitation are not automatically revoked. After installing the fix, administrators should audit mysql.global_priv for unexpected grants of ALL PRIVILEGES WITH GRANT OPTION, especially for accounts that were originally granted only SELECT.

Article: https://nefariousplan.com/posts/mariadb-json-schema-valid-crash-is-already-in-global-priv

PoC: https://github.com/dinosn/CVE-2026-32710