Connector/ODBC: MADB_Stmt::ArrayOffset is not reset when an exception unwinds out of MADB_StmtExecute, so the next paramset reads out of bounds

Bug reported by Yalguun Tumenkhuu was disclosed at November 4, 2026, 12:36 pm   |   Out-of-bounds Read

A vulnerability was identified in the Connector/ODBC library where an exception during parameter-array execute operations left the ArrayOffset variable in a stale state. When a server-reported error interrupted a parameter array, the ArrayOffset was not reset, causing the next paramset operation on the same statement handle to read from an incorrect memory location. This resulted in out-of-bounds reads that could either cause process crashes or silently drop rows from batches. The issue affected both scenarios where the application had or had not set the SQL_ATTR_PARAM_OPERATION_PTR attribute.

Connector/ODBC: SqlwcsOctetLen sizes UTF-16 with a byte-oriented helper, reading past the caller's buffer and sending client memory to the server

Bug reported by Yalguun Tumenkhuu was disclosed at November 4, 2026, 12:36 pm   |   Out-of-bounds Read

A buffer over-read vulnerability was identified in a database connector library's wide character string handling function. The function incorrectly sized UTF-16 strings by using a byte-oriented helper that inspected only the low byte of each code unit, causing the cursor to advance past the intended buffer boundary. This resulted in uninitialized memory being read and transmitted to the database server as part of SQL statements. The vulnerability affected the POSIX build and was triggered by ordinary characters from various languages. The memory disclosure was limited to 12-16 bytes per statement but occurred repeatedly during normal operation with affected character sets.

r2dbc-mariadb: server message accepted with no command in flight desynchronises the connection and serves one user's rows to another

Bug reported by Yalguun Tumenkhuu was disclosed at November 4, 2026, 12:35 pm   |   Information Disclosure

A vulnerability was discovered in an open-source database connector library that caused desynchronization of request and response messages on database connections. When a packet arrived from the server while no command was outstanding, the driver buffered it and served it to the next unrelated statement without validating any correlation between requests and responses. This allowed an attacker positioned on the network path to inject a single malicious packet that permanently shifted all subsequent responses, causing one user's data to be returned to another user and causing write operation results to be misreported. The vulnerability persisted for the lifetime of the affected connection and could not be detected by the application layer. The issue was confirmed in version 1.4.1 and the development branch, affecting the default configuration of the driver. The vulnerability required the attacker to be able to inject bytes into the client-server communication stream.

Connector/ODBC injects unquoted column names into positioned DELETE and UPDATE via MADB_DynStrGetWhere

Bug reported by Yalguun Tumenkhuu was disclosed at November 4, 2026, 12:35 pm   |   SQL Injection

A SQL injection vulnerability was discovered in the ODBC connector where unquoted column names were injected into positioned DELETE and UPDATE statements. The column values were properly escaped, but the column names were appended directly without any quoting or escaping. This allowed an attacker who could control a column or table name to execute arbitrary SQL on the application's connection with its privileges. When an application requested deletion of a single row, all rows in the table could be deleted instead. The vulnerability was present in versions 3.2.6 and 3.2.10, and affected both DELETE and UPDATE operations through positioned cursor operations.

Connector/ODBC SQLGetDescRec treats descriptor handle as statement handle, heap OOB write on every call

Bug reported by Yalguun Tumenkhuu was disclosed at November 4, 2026, 12:35 pm   |   Type Confusion

A heap buffer overflow vulnerability was discovered in the ODBC driver's SQLGetDescRec and SQLGetDescRecW functions. These functions incorrectly used a statement handle macro on a descriptor handle, causing writes 13 bytes past the end of a 720-byte descriptor allocation. On standard builds, this memory corruption was sufficient to trigger heap consistency checks and crash the process. Additionally, a portion of the buffer was filled with server-supplied version information, which allowed a network attacker to influence the offset of a secondary write operation. The vulnerability affected the current master branch of the driver and was confirmed to cause crashes and memory corruption.

Stack buffer overflow in 9 of 10 Connector/ODBC catalog functions via unbounded name

Bug reported by Yalguun Tumenkhuu was disclosed at November 4, 2026, 12:34 pm   |   Stack Overflow

A stack buffer overflow vulnerability was discovered in nine of ten catalog functions in a database connector driver. The affected functions failed to validate the length of application-supplied identifiers before escaping them into a fixed-size stack buffer. Identifiers longer than 256 bytes could overflow the 513-byte buffer with attacker-controlled data. The overflow occurred during query string assembly before communication with the server, requiring no database privileges or server cooperation. One catalog function properly validated identifier length and rejected oversized input, while the other nine did not perform this validation consistently.

Connector/C++ ignores allowMultiQueries and injects savepoint names into SQL

Bug reported by Yalguun Tumenkhuu was disclosed at November 4, 2026, 11:40 am   |   SQL Injection

Connector/C++ contained two SQL injection vulnerabilities in statement building. The driver ignored the allowMultiQueries configuration setting and passed a hardcoded flag to the database connection function, which caused stacked statements to be accepted on every connection regardless of the configuration. Additionally, savepoint names were concatenated directly into SQL statements without quoting or validation, allowing arbitrary SQL injection through the setSavepoint and releaseSavepoint methods. These defects were demonstrated to result in arbitrary DDL execution on a running database server.

Connector/C++ aborts client process on server session-tracking packet via std:toi

Bug reported by Yalguun Tumenkhuu was disclosed at November 4, 2026, 11:40 am   |   Uncontrolled Resource Consumption

A flaw was discovered in the Connector/C++ driver where the QueryProtocol::handleStateChange function improperly processed session-tracking packets from a server. The code attempted to parse a session variable name as an integer using std:toi, which caused an std::invalid_argument exception to be thrown. This exception type was not caught by the driver's error handling or by standard application exception handlers, resulting in an unhandled exception that terminated the client process. The vulnerability was triggered whenever a server sent a session-state-changed status flag with a SESSION_TRACK_SYSTEM_VARIABLES entry for auto_increment_increment. The root cause was that the code retrieved only the variable name from the packet instead of the corresponding value before attempting the conversion.

Connector/C++ string escaper re-escapes its own output, enabling SQL injection

Bug reported by Yalguun Tumenkhuu was disclosed at November 4, 2026, 11:39 am   |   SQL Injection

A string escaping vulnerability was discovered in the database connector's utility function that processed identifiers and literals for information schema queries. The escaper's inner loop advanced its search cursor incorrectly, causing it to re-escape characters it had already inserted. This resulted in runs of escape characters with odd lengths that left live escape characters to consume closing quotes. The vulnerability affected multiple metadata methods and identifier-quoting APIs, allowing SQL injection through untrusted table, schema, or column names. An independent defect in three sibling helper functions caused inconsistent escaping behavior, with two functions hardcoding an incorrect flag that disabled backslash escaping against default server configurations. Both defects were confirmed through testing against 336 payload shapes, with the escaping logic flaw alone closing all injection vectors. The vulnerability enabled unauthorized data access across database boundaries and boolean-based information extraction.