MariaDB Malicious UDF Creation (CVE-2026-32710)

Tim Peck@timpeck

•updated May 5, 2026•4•0•461

Detects the creation of a new MariaDB User-Defined Function (UDF) that loads a shared object (.so or .dll) file. This technique is used in the final stage of the CVE-2026-32710 attack chain to execute arbitrary OS commands, often from suspicious temporary or public directories.