MariaDB CVE-2026-92262 with CVSS 9.9 lets #mysql50# prefix corrupt tables

CVE-2026-92262 in MariaDB Server lets a table name with the #mysql50# prefix skip filename encoding and share a table cache entry with another table, allowing silent data corruption. Versions 10.6.1 through 13.0.1 are affected; fixes shipped in 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3 and 13.0.2.

• CVSS 9.9, CWE-706: t and #mysql50#t share one table cache key
• Exploit needs only ordinary ALL grants on the attacker's own schema
• Affected branches: 10.6, 10.11, 11.4, 11.8, 12.3 and 13.0
• Disclosed October 16, 2026 alongside two other 9.9-scored CVEs