MySQL Server CVE-2025-53040

Exploitation requires an authenticated session with HIGH MySQL privileges (CVSS PR:H) and network reachability to the server over one of MySQL's supported protocols; it does not require user interaction or a non-default configuration. The crafted input targets the Server: Optimizer component, so the attacker must be able to run queries the optimizer processes. The dominant limiting factor is the high-privilege prerequisite: the attacker must already possess a privileged account, which confines realistic exploitation to malicious insiders or compromised administrative/service credentials rather than anonymous remote attackers. Impact is limited to availability (hang or repeatable crash) - no data disclosure or modification is possible.

This is a moderate-severity availability-only vulnerability (CVSS 3.1 base 4.9) in the MySQL Server Optimizer component, and the signals are internally consistent rather than conflicting. The CVSS vector (AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H) indicates a network-reachable, low-complexity attack that nonetheless requires HIGH privileges (PR:H) and yields only an availability impact - a hang or repeatable crash (complete DoS) of the server, with no confidentiality or integrity loss. The EPSS score is low (0.58%, 46th percentile), there is no CISA KEV listing and no public exploit identified, so all exploitation signals point to low real-world urgency. The practical risk ceiling is further constrained by the PR:H requirement: an attacker able to supply the malicious query already holds high database privileges, so the primary threat model is an authenticated insider or a compromised high-privilege account degrading availability rather than mass, unauthenticated exploitation. Net assessment: a legitimate but low-to-moderate priority patch-management item, not an emergency - prioritize on normal Oracle Critical Patch Update cadence unless untrusted parties hold privileged MySQL accounts.

An attacker who already holds high MySQL privileges connects over the network via a supported protocol and submits a specially crafted query that the Optimizer mishandles, triggering uncontrolled resource consumption (CWE-400). The server hangs or crashes repeatedly, producing a complete denial of service for all database clients. No public proof-of-concept exploit has been identified at the time of analysis.