HackerOne Disclosed Reports - 2026-09-08

Critical
resolved

Stack Buffer Overflow in mariadb-dump quote_name() Allows Malicious Server to Execute Arbitrary Code on Client

Bug reported by Byte Override was disclosed at September 8, 2026, 1:30 pm   |   Stack Overflow

A stack buffer overflow was discovered in the quote_name() function of the mariadb-dump client application. The overflow occurred due to a lack of length validation on table names returned by a malicious MySQL server. This allowed a server to provide an excessively long table name that would overflow the fixed-size buffer, leading to the overwriting of the return address and other control-flow data on the stack. The vulnerability was confirmed to provide full control of the instruction pointer and several general-purpose registers, enabling remote code execution against any mariadb-dump client that connected to the malicious server.

High
resolved

Out-of-bounds read in MariaDB .frm parsing enables RCE via vtable hijacking

Bug reported by pinebudweiser was disclosed at September 8, 2026, 8:19 am   |   Out-of-bounds Read

A vulnerability was discovered in MariaDB where the `key_part->fieldnr` value parsed from a crafted `.frm` file was not validated before being used as an index into the `share->field[]` array. This resulted in an out-of-bounds read, allowing an attacker to hijack the C++ virtual method call and achieve arbitrary code execution within the context of the MariaDB server process. The vulnerability was successfully reproduced on MariaDB versions 10.4.18, 11.8.8, 12.3.2, and 13.1.0 Preview.