Connector/ODBC SQLGetDescRec treats descriptor handle as statement handle, heap OOB write on every call

内存破坏 / 类型混淆 / #3891337

厂商

MariaDB

严重程度

低危 · CVSS 5.7

赏金

—

弱点

类型混淆

研究员

@fg0x0

披露日期

2026-11-04

资产

MariaDB Server & Connectors - Data corruption, exfiltration, disclosure

CVE

—

该报告还没有中文解读。

Connector/ODBC SQLGetDescRec treats a descriptor handle as a statement handle

SQLRETURN SQL_API SQLGetDescRec(SQLHDESC DescriptorHandle, ...)
{
  CHECK_STMT_CLEAR_ERROR(DescriptorHandle);
  return MADB_DescGetRec(DescriptorHandle, ...);