Oracle Database Server CVE-2025-53051

Exploitation requires the attacker to already possess SYSDBA privilege - the highest-level administrative role in Oracle Database - and network reachability to the target via the Oracle Net protocol. Only Oracle Database Server versions 23.4 through 23.9 are affected. The overriding limiting factor is the SYSDBA prerequisite: an account at this privilege level already has broad read access to the database, so the vulnerability provides little practical benefit and realistic exploitation presumes prior full administrative compromise. Impact is limited to unauthorized read of a subset of Functional Index data, with no integrity or availability effect.

This is a low-priority, high-CVSS-nothing issue - in fact the CVSS 3.1 base score is only 2.7 (LOW). All signals point the same direction: the vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N shows that while the attack vector is network (Oracle Net) and complexity is low, exploitation requires PR:H - and the description makes explicit this means the attacker must already hold SYSDBA, the single most privileged role in an Oracle database. An actor with SYSDBA can already read essentially all data, so the marginal impact (unauthorized read of a subset of RDBMS Functional Index data, C:L, no integrity or availability impact) is negligible. EPSS reinforces this: 0.30% probability at the 21st percentile indicates very low expected exploitation. There is no CISA KEV listing and no public exploit identified. No signals conflict; the only minor data note is the 'Buffer Overflow' tag, which is inconsistent with the assigned CWE-125 (out-of-bounds read) - an OOB read is a disclosure primitive, not a classic overflow. This is a genuine but very low-risk finding whose exploitation is gated behind full administrative compromise.

An attacker who has already obtained SYSDBA credentials connects to the database over Oracle Net and crafts input that triggers an out-of-bounds read in the RDBMS Functional Index component, disclosing a subset of index-accessible data. Because SYSDBA is the highest privilege level, this scenario presupposes near-total prior compromise, making the vulnerability of marginal added value to an attacker. No public exploit code has been identified at time of analysis.