MySQL Server CVE-2025-53042

Exploitation requires an authenticated high-privileged MySQL account (PR:H) with network access to the MySQL Server over any of its supported protocols; no user interaction is needed (UI:N) and attack complexity is low (AC:L). The limiting factor is the high privilege requirement - the attacker must already hold administrative-level database access, which substantially narrows the realistic threat to malicious insiders or scenarios where high-privileged credentials have already been compromised. Affected deployments are MySQL Server versions 8.0.0-8.0.43, 8.4.0-8.4.6, and 9.0.0-9.4.0. Impact is limited to denial of service (server hang or repeatable crash); there is no confidentiality or integrity impact.

This is a genuinely LOW-to-moderate priority issue despite affecting an ubiquitous database. The CVSS 3.1 base score of 4.9 (MEDIUM) accurately reflects the limited blast radius: the only impact is availability (A:H, C:N/I:N) and exploitation requires high privileges (PR:H), meaning the attacker must already hold an administrative/high-privileged MySQL account. EPSS is 0.58% (46th percentile) - unremarkable, consistent with a privilege-gated DoS rather than a mass-exploitable flaw. There is no CISA KEV listing and no public exploit code identified, so this is not actively exploited at time of analysis. The signals are internally consistent (network vector + low complexity + high-priv auth + avail-only impact), with no contradictions to flag. The headline risk is overstated by the 'ubiquitous product' framing: the vulnerability in the MySQL Server Optimizer component only lets an already-trusted high-privileged user hang or crash the server (self-inflicted DoS territory), which most threat models treat as low-value for an attacker who already has that level of access. Note the CWE-400 (Uncontrolled Resource Consumption) classification aligns well with the described crash/hang behavior.

An attacker who already possesses a high-privileged MySQL account (e.g., a compromised admin credential or a malicious insider) connects over the network via one of MySQL's supported protocols and submits a crafted query that the Optimizer mishandles, causing the server to hang or repeatably crash. This yields a complete denial of service of the MySQL Server instance. No public proof-of-concept exploit has been identified at the time of analysis.