A security flaw has been found in versions 3.3.18 and 3.4.8 of MariaDB, a popular open-source database system that many websites use to store data like user account information, product listings, and site content. The vulnerability only triggers in specific circumstances: when a website takes unvetted user input (such as form entries or search terms), attempts to secure it using the standard mysql_real_escape_string() protective tool, and sends that input to the database using text protocol with the big5 character set enabled. In these cases, the protective tool fails to work as intended, leaving the database open to unauthorized access attacks (called SQL injections) even when developers have used standard security measures.
The issue has been fixed in updated MariaDB versions 3.3.19 and 3.4.9.
Source: NVD (National Vulnerability Database) — https://nvd.nist.gov/vuln/detail/CVE-2026-44172
