MySQL Server CVE-2026-47064

The attacker must possess a valid low-privileged MySQL database account with network connectivity to the MySQL instance - this is explicitly required per the CVSS vector (PR:L, AV:N). No non-default configuration or specific feature enablement is stated as a prerequisite; the flaw exists in the Optimizer component which is active in standard MySQL deployments. Exploitation does not require user interaction (UI:N) and has low attack complexity (AC:L), meaning no race condition, special timing, or victim action is needed once credentials are available. Factors limiting exploitation: unauthenticated external attackers cannot exploit this directly; the impact is confined to availability with no data exfiltration or integrity compromise possible (C:N, I:N); and scope is unchanged (S:U), preventing direct lateral movement. Deployments where all database accounts are tightly controlled and access is restricted to known application hosts have substantially reduced exposure.

The vendor-provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) scores 6.5, reflecting a network-reachable, low-complexity flaw requiring only low-privileged database credentials. The impact is exclusively availability - no confidentiality or integrity loss is possible, and scope is unchanged, meaning a successful attack cannot pivot to other systems directly. No EPSS score is present in available intelligence, so probabilistic exploitation likelihood cannot be quantified. The vulnerability is absent from the CISA KEV catalog and no public POC has been identified, which reduces immediate urgency somewhat. Nonetheless, the combination of AC:L and PR:L means that any legitimate but malicious database user - including a compromised application service account - can trigger this reliably and repeatably. In multi-tenant or shared hosting environments, the risk is elevated because one low-trust user can deny service to all others. Internet-exposed MySQL instances without credential controls are at the highest risk.

An attacker who holds any valid low-privileged MySQL account - whether obtained through credential theft, brute force, or a compromised application - connects to the database via the standard MySQL wire protocol and submits a specially crafted SQL query designed to trigger an unhandled condition in the Optimizer component. Because attack complexity is low and no race condition or special timing is required, the crash or hang is reproducible on demand. In a shared or multi-tenant database environment, the attacker repeats the query continuously, sustaining a denial of service that prevents all other users and applications from accessing the database.