MySQL Server CVE-2025-53053

Exploitation requires the attacker to already hold a high-privileged MySQL Server account (CVSS PR:H), which is the primary limiting factor - this is not reachable by anonymous or low-privileged users. Given valid privileged credentials, the attack is network-reachable over MySQL's multiple supported protocols with low complexity and no user interaction, targeting the Server: DML subsystem. Affected deployments are MySQL Server 8.0.0-8.0.43, 8.4.0-8.4.6, and 9.0.0-9.4.0; the key defensive constraints are strict control and monitoring of highly-privileged database accounts and upgrading to the fixed versions in the October 2025 Oracle CPU.

This is a moderate-severity (CVSS 5.5) denial-of-service and partial-integrity flaw in the MySQL Server DML component that signals a real but low-urgency priority. The CVSS vector (AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H) shows network reach and low attack complexity, but critically requires high privileges (PR:H) - meaning the attacker must already hold an authenticated, highly-privileged database account, which sharply limits the realistic threat population to insiders or attackers who have already compromised credentials. The impact is a complete DoS (A:H) plus limited unauthorized update/insert/delete (I:L) with no confidentiality loss (C:N). Corroborating exploitation signals are weak: EPSS is only 0.48% (39th percentile), there is no CISA KEV listing, and no public exploit code is referenced, so this is a high-CVSS-relative-to-impact but low-real-world-exploitation issue rather than an active threat. No SSVC decision data, no POC, and no KEV were provided in the input; the signals are internally consistent (a privileged-access DoS with low EPSS and no known exploitation), so there is no conflict to flag - the main caveat is that all exploitation-likelihood data points toward low urgency absent exposure of privileged accounts.

An attacker who has already obtained a high-privileged MySQL account (e.g., via credential theft, a compromised application service account, or a malicious insider) connects over the network through one of MySQL's supported protocols and issues crafted DML operations that exhaust server resources, causing MySQL Server to hang or repeatedly crash and resulting in a complete denial of service, alongside limited unauthorized data modification. No public exploit code is identified at time of analysis, and exploitation hinges entirely on prior possession of privileged credentials.