A security flaw tracked as CVE-2026-44172 has been identified in specific versions of MariaDB, a community-developed fork of the popular MySQL database software that many websites use to store content, user account information, and other site data. The issue impacts MariaDB versions 3.3.18 and 3.4.8. In these versions, a standard built-in security tool called mysql_real_escape_string() — which is designed to block harmful user input from being run as database commands — fails to work as intended if the database is set to use the big5 text character set, and user input is sent to the database via text protocol. This creates a risk of SQL injection attacks, where bad actors could exploit the gap to access, change, delete, or tamper with the data stored in your website's database. The MariaDB development team has already released patched versions (3.3.19 and 3.4.9) that resolve this vulnerability.
Source: NVD (National Vulnerability Database) — https://nvd.nist.gov/vuln/detail/CVE-2026-44172
