MySQL Server CVE-2025-53069

Exploitation requires the attacker to already hold high MySQL privileges (CVSS PR:H) and network access to the server via one of the multiple supported MySQL protocols; the flaw resides in the Server: Components Services component and leads only to denial of service (hang or repeatable crash). This is NOT remote unauthenticated exploitation - the high-privilege prerequisite is the primary limiting factor, confining realistic exploitation to insiders or already-compromised privileged accounts. Affected deployments are MySQL Server 8.0.0-8.0.43, 8.4.0-8.4.6, and 9.0.0-9.4.0; no user interaction is needed once the privileged connection is established.

This is a moderate-severity availability issue that in practice is a low priority for most organizations. The CVSS 3.1 base score of 4.9 reflects the combination of network reach (AV:N), low attack complexity (AC:L), and no user interaction (UI:N), but these are offset by the requirement for high privileges (PR:H) and an impact limited strictly to availability (C:N/I:N/A:H) with no scope change (S:U). The EPSS score of 0.58% (46th percentile) indicates low predicted exploitation probability, which is consistent with the absence of a CISA KEV listing and no identified public proof-of-concept. All signals align here - there is no conflict between a high CVSS and real-world risk because the CVSS itself is modest. The key limiting factor is PR:H: an attacker must already hold high database privileges, meaning this is realistically an insider or post-compromise concern rather than an external pre-auth threat. No SSVC decision data was provided in the input. Net assessment: a legitimate issue to patch on a normal maintenance cadence, but not an emergency given the privilege barrier, DoS-only impact, and low exploitation signals.

An attacker who already possesses high-privilege credentials on a MySQL Server instance connects over the network via one of the supported protocols and issues crafted requests to the Server: Components Services component that trigger uncontrolled resource allocation (CWE-770), causing the server to hang or repeatedly crash into a complete denial of service. Because privileges are required, the most realistic actor is a malicious insider or an attacker who has already obtained administrative database access. No public exploit code has been identified at time of analysis.