A security flaw has been found in MariaDB, a widely used open-source database system for websites, affecting versions 3.3.18 and 3.4.8. The issue impacts sites that accept unvalidated user input, use the big5 character set, and send that input to the database via text protocol. Even when sites used the standard mysql_real_escape_string() tool, which is designed to block SQL injection attacks (attempts by bad actors to manipulate database queries to steal, change or delete your site's data), the protection did not work as intended, leaving these sites vulnerable to such attacks. The MariaDB development team has released patched versions 3.3.19 and 3.4.9 that fix this vulnerability.
Source: NVD (National Vulnerability Database) — https://nvd.nist.gov/vuln/detail/CVE-2026-44172