Oracle MySQL Server CVE-2025-53045

Requires an authenticated HIGH-privileged MySQL Server account (PR:H) with network access over one of MySQL's supported protocols; no user interaction is needed. Limiting factors that reduce real-world risk: the attacker must already possess elevated database privileges, so exploitation is confined to trusted/privileged users, compromised DBA credentials, or malicious insiders rather than unauthenticated remote attackers. Affected deployments are MySQL Server 8.0.0-8.0.43, 8.4.0-8.4.6, and 9.0.0-9.4.0; the description names no special non-default feature or configuration, implying the default InnoDB storage engine is sufficient to trigger the flaw. Impact is limited to availability (hang or repeatable crash) with no data exposure or modification.

This is a moderate-severity availability-only flaw (CVSS 3.1 base 4.9) in Oracle MySQL Server's InnoDB engine (CWE-400, uncontrolled resource consumption). The CVSS vector (AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H) is internally consistent with the description: network-reachable, low attack complexity, but requiring a HIGH-privileged account (PR:H), no user interaction, and causing only a denial of service (hang or repeatable crash) with no confidentiality or integrity impact. The signals align toward LOW real-world urgency rather than a top priority: EPSS is 0.58% (46th percentile), the vulnerability is NOT in CISA KEV, and no public exploit or SSVC automatable/exploitation data was supplied. The PR:H requirement is the dominant mitigating factor - an attacker must already hold high database privileges, so this is primarily a risk from compromised privileged credentials or malicious/insider DBAs rather than anonymous internet attackers. No signals conflict; all point to a real but low-priority availability bug. Missing data: no SSVC decision values, no KEV/POC confirmation, and the exact triggering InnoDB operation is not described.

An attacker who has already obtained a high-privilege MySQL account (e.g., via credential theft or a malicious insider) connects over the network using one of MySQL's supported protocols and issues a crafted operation that drives InnoDB into uncontrolled resource consumption. The server hangs or repeatedly crashes, producing a complete denial of service for all dependent applications. No public exploit was identified at time of analysis, and low attack complexity means the action is reliable once privileged access exists.