CVE-2026-44172: MariaDB: mysql_real_escape_string() incorrectly handled big5

Synopsis

SQL injection vulnerability in MariaDB server affects applications using the mysql_real_escape_string() function with the big5 character set. The flaw is reachable over the network with no authentication required, allowing a remote unauthenticated attacker to send crafted input that bypasses the escaping function entirely. Successful exploitation gives the attacker read and write access to the database, enabling theft of stored data and unauthorized modification of database records. HarborGuard is tracking this advisory and will make a patched-image rebuild available as soon as upstream publishes a fix version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must be able to reach the MariaDB-backed application over the network; no prior foothold on the host is needed.

• AuthenticationNot required

  No credentials or account are required; the injection is exercisable through any public-facing input that passes data to the affected escaping function.

• Victim interactionNot required

  No victim action is needed; the attacker sends crafted input directly without relying on a user to click a link or open a file.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special environmental conditions, race windows, or memory layout knowledge.

Blast Radius

• Reads arbitrary database rows, including stored credentials, session tokens, and user records accessible to the application's database account.
• Writes or modifies persisted database rows, allowing an attacker to alter application data, escalate privileges within the application, or corrupt records.
• Availability is not impacted according to the CVSS scoring; the service continues running while data is silently read or tampered with.