MariaDB server is a community developed fork of MySQL server. An authenticated user can crash MariaDB versions 11.4 before 11.4.10 and 11.8 before 11.8.6 via a bug in JSON_SCHEMA_VALID() function. Under certain conditions it might be possible to turn the crash into a remote code execution. These conditions require tight control over memory layout which is generally only attainable in a lab environment. This issue is fixed in MariaDB 11.4.10, MariaDB 11.8.6, and MariaDB 12.2.2.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:19182 advisory.

    MariaDB is a multi-user, multi-threaded SQL database server that is binary compatible with MySQL.

    Security Fix(es):

    * MariaDB: MariaDB: Remote Code Execution or Denial of Service via JSON_SCHEMA_VALID() function     vulnerability (CVE-2026-32710)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:19021 advisory.

    MariaDB is a community developed fork from MySQL - a multi-user, multi-threaded SQL database server. It is     a client/server implementation consisting of a server daemon (mariadbd) and many different client programs     and libraries. The base package contains the standard MariaDB/MySQL client programs and utilities.

    Security Fix(es):

    * MariaDB: MariaDB: Remote Code Execution or Denial of Service via JSON_SCHEMA_VALID() function     vulnerability (CVE-2026-32710)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has packages installed that are affected by a vulnerability as referenced in the openSUSE- SU-2026:20629-1 advisory.

    This update for mariadb fixes the following issue:

    - Update to v11.8.6
    - CVE-2026-32710: heap-based buffer overflow via `JSON_SCHEMA_VALID()` can lead to crash or remote code     execution (bsc#1260081).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES16 / SLES_SAP16 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:21407-1 advisory.

    This update for mariadb fixes the following issue:

    - Update to v11.8.6
    - CVE-2026-32710: heap-based buffer overflow via `JSON_SCHEMA_VALID()` can lead to crash or remote code     execution (bsc#1260081).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:1367-1 advisory.

    Update to version 11.8.6.

    - https://mariadb.com/docs/release-notes/community-server/11.8/11.8.6
    - https://mariadb.com/docs/release-notes/community-server/changelogs/11.8/11.8.6

    Security issues fixed:

    - CVE-2026-32710: heap-based buffer overflow via `JSON_SCHEMA_VALID()` can lead to crash or remote code     execution       (bsc#1260081).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of MariaDB installed on the remote host is prior to 11.4.10. It is, therefore, affected by a vulnerability as referenced in the GHSA-4rj5-2227-9wgc advisory.

  - MariaDB server is a community developed fork of MySQL server. An authenticated user can crash MariaDB     versions 11.4 before 11.4.10 and 11.8 before 11.8.6 via a bug in JSON_SCHEMA_VALID() function. Under     certain conditions it might be possible to turn the crash into a remote code execution. These conditions     require tight control over memory layout which is generally only attainable in a lab environment. This     issue is fixed in MariaDB 11.4.10, MariaDB 11.8.6, and MariaDB 12.2.2. (CVE-2026-32710)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of MariaDB installed on the remote host is prior to 11.8.6. It is, therefore, affected by a vulnerability as referenced in the GHSA-4rj5-2227-9wgc advisory.

  - MariaDB server is a community developed fork of MySQL server. An authenticated user can crash MariaDB     versions 11.4 before 11.4.10 and 11.8 before 11.8.6 via a bug in JSON_SCHEMA_VALID() function. Under     certain conditions it might be possible to turn the crash into a remote code execution. These conditions     require tight control over memory layout which is generally only attainable in a lab environment. This     issue is fixed in MariaDB 11.4.10, MariaDB 11.8.6, and MariaDB 12.2.2. (CVE-2026-32710)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of MariaDB installed on the remote host is prior to 12.2.2. It is, therefore, affected by a vulnerability as referenced in the GHSA-4rj5-2227-9wgc advisory.

  - MariaDB server is a community developed fork of MySQL server. An authenticated user can crash MariaDB     versions 11.4 before 11.4.10 and 11.8 before 11.8.6 via a bug in JSON_SCHEMA_VALID() function. Under     certain conditions it might be possible to turn the crash into a remote code execution. These conditions     require tight control over memory layout which is generally only attainable in a lab environment. This     issue is fixed in MariaDB 11.4.10, MariaDB 11.8.6, and MariaDB 12.2.2. (CVE-2026-32710)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - MariaDB server is a community developed fork of MySQL server. An authenticated user can crash MariaDB     versions 11.4 before 11.4.10 and 11.8 before 11.8.6 via a bug in JSON_SCHEMA_VALID() function. Under     certain conditions it might be possible to turn the crash into a remote code execution. These conditions     require tight control over memory layout which is generally only attainable in a lab environment. This     issue is fixed in MariaDB 11.4.10, MariaDB 11.8.6, and MariaDB 12.2.2. (CVE-2026-32710)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
315477	RHEL 9 : mariadb:11.8 (RHSA-2026:19182)	Nessus	Red Hat Local Security Checks	critical
315423	RHEL 10 : galera and mariadb11.8 (RHSA-2026:19021)	Nessus	Red Hat Local Security Checks	critical
311760	openSUSE 16 Security Update : mariadb (openSUSE-SU-2026:20629-1)	Nessus	SuSE Local Security Checks	critical
311747	SUSE SLES16 Security Update : mariadb (SUSE-SU-2026:21407-1)	Nessus	SuSE Local Security Checks	critical
306707	SUSE SLES15 Security Update : mariadb (SUSE-SU-2026:1367-1)	Nessus	SuSE Local Security Checks	critical
305875	MariaDB 11.4.1 < 11.4.10 DoS	Nessus	Databases	critical
305874	MariaDB 11.8.1 < 11.8.6 DoS	Nessus	Databases	critical
305873	MariaDB 12.1.2 < 12.2.2 DoS	Nessus	Databases	critical
303254	Linux Distros Unpatched Vulnerability : CVE-2026-32710	Nessus	Misc.	critical

Detections

Analytics

CVE-2026-32710

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

critical