MySQL Connector/ODBC CVE-2026-101804

Exploitation requires the attacker to already possess a logon to the infrastructure/host where MySQL Connector/ODBC 26.7.1 executes (AV:L), and success additionally depends on interaction from a different human victim (UI:R) plus specialized conditions reflected by high attack complexity (AC:H). These limiting factors - local presence, a separate interacting victim, and difficult-to-arrange preconditions - make realistic exploitation narrow despite PR:N, and the impact is capped at a partial denial of service of the connector with no data confidentiality or integrity effect.

This is a low-priority, low-severity issue. The Oracle-assigned CVSS 3.1 base score is 2.5 with vector AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L, meaning local access to the host, high attack complexity, user interaction, and only a partial availability (DoS) impact with no confidentiality or integrity effect. Although PR:N indicates no privileges are required, the attacker must already have a logon to the infrastructure where MySQL Connectors runs (AV:L), which sharply limits reach. No EPSS score, CISA KEV listing, or public POC is present in the provided data, so there is no public exploit identified at time of analysis and no evidence of active exploitation. All signals are consistent and point the same direction - a minor, hard-to-exploit local DoS, not a widespread threat. The only mild tension is PR:N combined with AV:L and 'unauthenticated attacker with logon,' which reflects Oracle's convention that a logged-on but unprivileged user needs no application-level authentication; this is not a conflict but is worth noting. No key signals are missing beyond the CWE, which is listed as N/A.

A local, logged-on user on a host where MySQL Connector/ODBC is installed crafts conditions (e.g., a malicious input or resource) that, when another user interacts with the connector, triggers a fault causing a partial denial of service of the connector. The high complexity and need for interaction from a separate victim make the scenario opportunistic rather than reliable. No public exploit code is identified at time of analysis.