MySQL Server CVE-2026-101756

Exploitation requires the attacker to hold a high-privilege MySQL account (PR:H) and network access to the database via one of the multiple supported MySQL protocols; the malformed input targets the Server: GIS (spatial/geometry) component, so instances actively using GIS/spatial functionality are the relevant attack surface. No user interaction is needed (UI:N). The primary limiting factor is the high-privilege authentication requirement, which restricts realistic abuse to trusted insiders or attackers who have already compromised privileged credentials; impact is confined to availability (service hang/crash) with no data confidentiality or integrity effect. Affected releases are MySQL Server/Cluster 9.7.0-9.7.3 and 26.7.0-26.7.1 - other versions are not in scope.

This is a moderate-severity, low-real-world-priority issue despite affecting ubiquitous software. The CVSS 3.1 base score is 4.9 (MEDIUM) with vector AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H - the only impact is availability (A:H), with no confidentiality or integrity consequences, and exploitation requires high privileges (PR:H), meaning the attacker must already hold a privileged MySQL account. Although the attack vector is network (AV:N) with low complexity (AC:L) and no user interaction, the PR:H requirement sharply limits the realistic threat population to insiders or attackers who have already obtained high-privilege credentials. No EPSS score is provided in the input, so exploitation probability cannot be quantified; the vulnerability is NOT listed in CISA KEV and NO public proof-of-concept is referenced, so there is no evidence of active exploitation or available exploit code. The outcome is a complete denial of service (hang or repeatable crash) of the database, not code execution or data compromise. Net assessment: a legitimate but low-urgency patch-cycle item - a privileged user can crash the server, which is far less critical than an unauthenticated RCE. No key signals are directly conflicting, but the absence of EPSS and CWE data limits precision; the description's 'Easily exploitable' phrasing (Oracle's standard wording) is consistent with AC:L but does not override the PR:H gating.

An attacker who already possesses a high-privilege MySQL account (or has compromised such credentials) connects over the network via one of several supported protocols and submits crafted GIS/spatial queries or input to the Server: GIS component. The malformed request triggers a hang or repeatable crash, producing a complete denial of service of the MySQL Server or Cluster. No public exploit code is identified at time of analysis, and the attack yields no data disclosure or modification.