Heap buffer overflow in MariaDB JSON_SCHEMA_VALID()

This repository is a working exploit lab for CVE-2026-32710 targeting MariaDB 11.4.x, confirmed on 11.4.9. It is not a scanner or detector; it contains a full exploit chain. The main component is exploit.py, a standalone Python exploit that implements a minimal MySQL/MariaDB protocol client over raw TCP sockets and performs a two-stage attack. Stage 1 exploits a heap out-of-bounds write in JSON_SCHEMA_VALID() to corrupt user-variable metadata and achieve a two-hop arbitrary write into Security_context::master_access, turning a SELECT-only account into one with ALL PRIVILEGES WITH GRANT OPTION. It then persists the escalation with GRANT ALL so the privilege change survives the eventual session crash and restart. Stage 2 uses the elevated privileges to load a malicious UDF shared library into the MariaDB plugin directory and invoke sys_exec() to run arbitrary operating system commands as the mysql user. Repository structure is small and purpose-built: exploit.py is the primary exploit; raptor_udf.c is the malicious UDF source implementing sys_exec() via system(); Dockerfile builds a MariaDB 11.4.9 lab image, compiles the UDF, and weakens plugin_dir permissions for convenience; init.sql creates the initial lowpriv account with only SELECT on test.*; setup.sh automates building and launching the vulnerable Docker lab with SYS_PTRACE and port 3306 exposed; README.md documents the vulnerability, exploitation stages, constraints, and usage. The exploit’s main capability is privilege escalation followed by command execution. It targets MariaDB over the network using SQL queries sent to TCP/3306, but it also relies on local/container introspection in the provided lab to read /proc/1/mem and discover heap addresses needed for reliable exploitation. The README explicitly notes that the actual corruption and arbitrary-write chain are pure SQL over TCP, while the memory introspection is a lab-only substitute for a real info leak. Because the payload is functional but environment-specific and not integrated into a broader exploitation framework, the maturity is best classified as OPERATIONAL.