CVE-2023-52970: mariadb Insecure Automated Optimizations
CVSS: 4.9v3.1MediumDeferred
AliasesUBUNTU-CVE-2023-52970DEBIAN-CVE-2023-52970CGA-2p6v-8jfc-wr97CGA-36gf-hwq4-53mvCGA-3rf9-34m9-9wg8CGA-4fhh-xf32-fw2vCGA-5frv-xm7q-7pchCGA-8p7m-5hhf-j295CGA-98v4-3v55-5w6jCGA-9j44-j649-6j4jCGA-hpm2-7h5q-h4gwCGA-hvvw-j4qm-99qwCGA-jpjx-98qh-qwxpCGA-p2gm-x2hh-9mr9CGA-p8gh-g73p-2xvmCGA-r9m3-hwcv-62xxCGA-rcf6-44qr-j82mCGA-rf6c-qh9f-v82cCGA-xw5m-227w-86vm
Published 08-03-2025Last modified 03-11-2025
Vulnerability summary
CVE-2023-52970 is a medium (CVSS 4.9) Insecure Automated Optimizations vulnerability in mariadb. EPSS estimates a 0.46% chance of exploitation in the next 30 days, higher than 38.3% of scored vulnerabilities.
CVSS score
4.9/10
010
Medium · v3.1 (CVE.org)EPSS score
0.46%
0%100%
Low · +0.01 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 15 · Related 5Timeline
- 08-03-2025PublishedVulnerability first disclosed.
- 03-11-2025Last modifiedVulnerability information updated.
Description
MariaDB Server 10.4 through 10.5.*, 10.6 through 10.6.*, 10.7 through 10.11.*, 11.0 through 11.0.*, and 11.1 through 11.4.* crashes in Item_direct_view_ref::derived_field_transformer_for_where.
CVSS metrics
4 scores · 4 sources · 1 versionMedium 4.9Preferred score · CVE.org (CNA)
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:HSourcesAll 4 agree
- OSV · UbuntuEcosystem advisory · calculated4.9MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated4.9MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
- NVDNIST4.9MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
0.46%
Chance of exploitation in the next 30 days
Percentile
38%
Versus all other CVEs
30-day change
+0.01 pp
From 0.45% on 19-09-2026
19-09-202619-10-2026
EPSS score0.46%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Chainguard9 products
- mariadb-10.11< 10.11.14-r0
- mariadb-10.11-embedded< 10.11.19-r2
- mariadb-10.6< 10.6.23-r0
- mariadb-11.2All versions (No fix recorded)
- mariadb-11.4< 11.4.8-r0
Wolfi9 products
- mariadb-10.11< 10.11.14-r0
- mariadb-10.11-embedded< 10.11.19-r2
- mariadb-10.6< 10.6.23-r0
- mariadb-11.2All versions (No fix recorded)
- mariadb-11.4< 11.4.8-r0
Ubuntu2 products
- mariadb< 1:10.11.13-0ubuntu0.24.04.1
- mariadb-10.6< 1:10.6.22-0ubuntu0.22.04.1
Debian1 product
- mariadb< 1:10.11.13-0+deb12u1 | < 1:11.8.2-1
Mariadb1 product
- mariadb≥ 10.4, < 10.5.* | ≥ 10.6, < 10.6.* | ≥ 10.7, < 10.11.* | ≥ 11.0, < 11.0.* | ≥ 11.1, < 11.4.*
5 vendors · 22 products
