a NULL pointer dereference on tmp_table->file when computing keyuse->ref_table_rows, located in sql/sql_select.cc at line 7687

This vulnerability occurs in MariaDB's optimize_keyuse function, located in sql/sql_select.cc at line 7687. A segmentation fault (SIGSEGV) is triggered due to a NULL pointer dereference on tmp_table->file when computing keyuse->ref_table_rows. The issue arises during the join optimization phase, where insufficient null checks on temporary table references can lead to a crash. An attacker can exploit this flaw to cause a denial-of-service (DoS) via specially crafted SQL queries.