LiveActive security incident?Get immediate response
CVE Record

CVE-2021-46662: MariaDB through 10.5.9 allows a set_var.cc application crash via certain uses of an UPDATE statement in con...

MariaDB through 10.5.9 allows a set_var.cc application crash via certain uses of an UPDATE statement in conjunction with a nested subquery.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

This CVE describes a MariaDB crash condition. Certain UPDATE statements combined with a nested subquery can crash the application in MariaDB through 10.5.9. The main business risk is database availability disruption, not proven data theft. The source bundle does not provide CVSS scoring or evidence of active exploitation.

Executive priority

Address during normal vulnerability maintenance unless the affected database is critical, internet-adjacent, or reachable by untrusted SQL paths. Escalate if crashes have been observed or if a vendor advisory marks a specific product as affected.

Technical view

The reported flaw is in MariaDB set_var.cc and is triggered by specific UPDATE usage with a nested subquery. Public metadata says MariaDB through 10.5.9 is affected. The bundle does not include exploit status, CWE mapping, CVSS details, or a complete vendor remediation statement.

Likely exposure

Exposure is most likely where MariaDB through 10.5.9 is deployed and untrusted or less-trusted users can submit SQL that reaches the database. Downstream exposure may also exist in products that bundle MariaDB, as indicated by the NetApp advisory.

Exploitation context

CISA KEV status is false in the provided bundle, and no cited source in the bundle states active exploitation. Treat this as a denial-of-service style risk requiring SQL execution capability or an application path that can generate the affected statement pattern.

Researcher notes

Evidence is limited to public CVE metadata and linked advisories. The bundle supports an application crash in MariaDB through 10.5.9 but does not provide CVSS, CWE, exploit-in-the-wild evidence, or detailed remediation text. Avoid making product-specific claims beyond the cited advisories.

Mitigation direction

  • Inventory MariaDB instances and identify versions through 10.5.9.
  • Check MariaDB security guidance for fixed versions or supported backports.
  • Review NetApp advisory applicability for bundled or managed MariaDB components.
  • Restrict direct database access to trusted users and services.
  • Prioritize upgrade planning for internet-facing or business-critical database services.

Validation and detection

  • Confirm MariaDB version on each database server or bundled appliance.
  • Map applications and users that can issue UPDATE statements to MariaDB.
  • Check vendor advisories for fixed builds before changing production systems.
  • Review database crash logs for unexplained failures around complex UPDATE queries.
  • Verify backups and recovery procedures for affected database services.
Prepared
Confidence
medium
Sources
5

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2021-46662 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
0Timeline events
0ADP providers
4Source links

CVSS and timeline data

No CVSS vectors or timeline events were available in the normalized CVE source material.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
n/an/an/aListed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.