CVE-2026-92262criticalCWE-706

CVE-2026-92262: critical vulnerability in MariaDB server

MariaDB: Numerous issues caused by historical #mysql50# tablename encoding bypass.

Published 16 Oct 2026

48Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendcvss 9.9epss 0.7%

from disclosure to weapon2 days

Published on NVDOct 16

1st PoC+2d

exploitation probability

0.7%top 49% of all CVEs

observed exploitation

nono source reports it

1 public exploit(s)

MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the #mysql50# bypass prefix is affected because it allows the #mysql50# prefix to bypass normal table-name filesystem encoding. An attacker can trigger the issue with a table name using the #mysql50# prefix, then use a #mysql50# table name to access files under their legacy unencoded name and cause crashes, data corruption, data exfiltration, or remote code execution. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Affected products

MariaDB · server

public PoCs found — 1

githubgithub.com/SeanDishman/mariadb-cve-2026-92262★ 0

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Related CVEs — MariaDB server

In the same product, most dangerous first.

CVE-2026-44170MEDIUMMariaDB: Argument injection in CONNECT REST Xcurl on Windows via unsanitized URLEPSS 1.7%CVE-2026-49261CRITICALMariaDB server has unsafe parameter handling in `wsrep_notify_cmd`EPSS 1.7%CVE-2026-48165HIGHMariaDB: unsafe usage of `wsrep_sst_receive_address` values on the joiner sideEPSS 1.6%CVE-2026-48163HIGHMariaDB: wsrep SST unsafe parameter handling on the donor side (rsync)EPSS 1.1%CVE-2026-44172MEDIUMMariaDB: mysql_real_escape_string() incorrectly handled big5EPSS 1.0%CVE-2026-44168HIGHMariaDB: wsrep SST unsafe parameter handling on the donor sideEPSS 1.0%

References