Remote Code Execution Vulnerabilities Disclosed in MariaDB

• •Two RCE vulnerabilities reported in MariaDB could be exploited by low-privilege users.
• •The vulnerabilities involve use-after-free and heap over-read conditions.
• •No patches or confirmed exploitation have been reported yet.

Two separate reports submitted to HackerOne detail vulnerabilities in MariaDB that could lead to remote code execution (RCE). The first report, submitted by Rick de Jager, describes a low-privilege RCE vulnerability involving an use-after-free condition in SYS_REFCURSOR and a heap over-read related to ST_Area. The second report, by Akhil Koul, highlights a heap use-after-free vulnerability in Materialized_cursor::open due to SYS_REFCURSOR array reallocation. Both vulnerabilities rely on memory safety issues and could potentially allow attackers with low-level privileges to execute arbitrary code on the database server. The reports lack detailed technical information, including proof of concept and affected versions. As of now, there is no confirmation of exploitation in the wild, and the vulnerabilities remain.