MySQL Server CVE-2025-53067

Exploitation requires a high-privilege MySQL Server account (PR:H) with network access via one of multiple supported protocols to an affected instance running versions 9.0.0 through 9.4.0; no user interaction is needed. The attacker must be able to issue queries that reach the Optimizer component. The decisive limiting factor is the high-privilege authentication requirement - this is not exploitable by anonymous or low-privileged users - which confines realistic abuse to trusted administrators, malicious insiders, or attackers who have already compromised a privileged database credential. Impact is limited to availability (crash/hang); no data disclosure or modification occurs.

This is a moderate-severity (CVSS 4.9) availability-only vulnerability in the MySQL Server Optimizer component. The CVSS vector (AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H) indicates network-reachable, low-complexity exploitation but requires high privileges (PR:H), which is the dominant mitigating factor - an attacker must already hold a highly privileged MySQL account before this flaw can be abused. There is no public exploit identified at time of analysis and no CISA KEV listing. The EPSS score of 0.58% (46th percentile) corroborates a low probability of exploitation in the wild, consistent with the high-privilege prerequisite and DoS-only impact (no confidentiality or integrity loss). All available signals align: this is a genuine but low-priority issue, not a high-CVSS-but-low-real-risk mismatch - the CVSS score itself is already modest. The realistic risk is an authenticated insider or a compromised privileged credential causing a repeatable crash/hang, rather than mass external exploitation. No SSVC decision data was provided in the input, so exploitation-automatable/technical-impact scoring cannot be independently cited.

An attacker who already possesses high-privilege MySQL credentials connects over the network and submits a specially crafted query that abuses the Optimizer component, causing the server to hang or enter a frequently repeatable crash (complete denial of service). No public proof-of-concept exists, and because high privileges are required (PR:H), the scenario is most plausible for a malicious insider or an adversary who has already compromised an administrative database account.