CVE-2023-26785

An attacker with access to the MariaDB server can place a malicious shared file (library .so) containing UDF code, and then register it in the database using the 'CREATE FUNCTION' command. When this function is executed, the malicious code is run in the context of the database server process. MariaDB Foundation disputes the classification as a vulnerability, arguing that there is no privilege escalation — meaning the technique requires having appropriate permissions in the database.

An attacker can obtain remote code execution (RCE) on the server hosting MariaDB, potentially taking full control of the operating system, including access to sensitive data and the ability to modify or destroy resources.

Patches available from the vendor should be applied according to references. Due to the disputed nature of the vulnerability, it is recommended to apply the principle of least privilege for database accounts, limit the ability to load external UDF libraries, and implement restrictive access control to the MariaDB server.

MariaDB version 10.5