MySQL Server CVE-2025-53044

Exploitation requires an authenticated, HIGH-privileged MySQL account (CVSS PR:H) with network access to the MySQL Server over one of its supported protocols; the flaw targets the InnoDB storage engine component. The decisive limiting factor is the privilege requirement - an attacker must already hold a privileged database account, restricting the realistic threat to insiders or post-credential-compromise scenarios rather than anonymous remote attackers. No specific non-default configuration is called out; affected versions are MySQL Server 8.0.0-8.0.43, 8.4.0-8.4.6, and 9.0.0-9.4.0. Impact is limited strictly to availability (service hang or repeatable crash) with no data disclosure or modification.

This is a genuine-but-low-priority availability flaw, not an urgent one. The CVSS 3.1 base score is only 4.9 (Medium), driven entirely by availability impact (A:H) with no confidentiality or integrity effect (C:N/I:N). The vector (AV:N/AC:L/PR:H/UI:N/S:U) shows network reach and low complexity, but crucially requires high privileges (PR:H) - an attacker must already hold a privileged MySQL account, which sharply narrows the realistic threat to insiders or an attacker who has already compromised privileged credentials. The EPSS score of 0.58% (46th percentile) indicates low predicted exploitation likelihood, consistent with its DoS-only impact and privilege barrier. The CVE is NOT on CISA KEV and no public exploit code was identified, so there is no evidence of active or opportunistic exploitation. Oracle's advisory characterizes it as 'easily exploitable,' which aligns with AC:L but should be read in the context of the PR:H precondition - easy to trigger once you already have privileged access. All signals are mutually consistent (Medium severity, low EPSS, no KEV, DoS-only, privilege-gated), so there is no conflicting data to reconcile. No vendor-confirmed patched build number is given in the input beyond the October 2025 CPU reference.

An attacker who already possesses a high-privileged MySQL account (e.g., a malicious insider or an adversary who has stolen admin credentials) connects to the server over the network via a supported protocol and issues a crafted operation against the InnoDB storage engine that exhausts resources, causing the server to hang or repeatedly crash. The result is a complete denial of service of the database. No public proof-of-concept exploit was identified at the time of analysis.