Oracle MySQL Server CVE-2025-53054

Exploitation requires an authenticated MySQL account with HIGH privileges (PR:H) and network reachability to the MySQL Server over one of its supported protocols; the flaw is in the InnoDB storage engine, which is the default engine, so no special non-default configuration is indicated by the description. The primary limiting factor is the elevated privilege prerequisite: the attacker must already hold an administrative/high-privilege database account, which sharply reduces exposure in single-tenant deployments where only trusted operators have such access. No user interaction is required (UI:N). Affected and therefore exploitable builds are MySQL Server 8.0.0-8.0.43, 8.4.0-8.4.6, and 9.0.0-9.4.0; environments patched via Oracle CPU October 2025 are not exploitable.

This is a genuine but moderate-priority issue, not a top-tier emergency. The CVSS 3.1 base score is 5.5 (MEDIUM), and the vector (AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H) is internally consistent with the description: network-reachable and low-complexity, but gated behind HIGH privileges (PR:H), meaning the attacker must already hold an elevated/administrative MySQL account. The dominant impact is Availability (A:H - complete DoS via hang or repeatable crash) with limited Integrity impact (I:L - some unauthorized update/insert/delete) and no Confidentiality impact (C:N), matching CWE-400 (uncontrolled resource consumption) in InnoDB. Supporting signals point to low real-world urgency: EPSS is 0.48% (39th percentile), there is no CISA KEV listing, and no public exploit was identified. The signals are consistent rather than conflicting - a high-privilege DoS flaw with low exploitation probability. The practical risk is mainly in multi-tenant or shared database environments where lower-trust but still-authenticated privileged users exist, or where a privileged credential could be compromised; against a single-tenant DB where only trusted admins have high privileges, the residual risk is low.

An attacker who already possesses a high-privileged MySQL account (e.g., a compromised admin credential or a malicious privileged tenant in a shared database) connects over the network via a supported protocol and issues crafted operations that trigger uncontrolled resource consumption in InnoDB, hanging or repeatedly crashing the server for a complete denial of service, and potentially performing limited unauthorized data modification. No public exploit code was identified at time of analysis, and the low attack complexity (AC:L) means exploitation is straightforward once privileged access is obtained.