MySQL Server CVE-2026-61108

Exploitation requires a valid low-privilege MySQL user account with network access to the MySQL Server or Cluster instance (PR:L per CVSS vector). The attack is directed at the GIS/spatial component, meaning the vulnerability is reachable via any query path that exercises MySQL's spatial functions - no specific non-default configuration of the GIS feature is stated as required. Attack complexity is low (AC:L) and no user interaction is needed (UI:N), confirming that once credentials are obtained, exploitation is straightforward across multiple supported MySQL protocols (e.g., classic MySQL protocol, X Protocol). The primary limiting factor is the requirement for authenticated access: unauthenticated remote exploitation is not supported by the CVSS vector (PR:L, not PR:N). Environments where all database users are tightly controlled and least-privilege principles are enforced face substantially lower realistic risk than multi-tenant or developer/shared environments where many accounts exist.

The CVSS 3.1 score of 6.5 with vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H indicates a medium-severity, high-availability-impact vulnerability requiring only low-privilege network authentication and no special attack complexity. The impact is scoped entirely to availability - confidentiality and integrity are unaffected. No EPSS score was provided, so exploitation probability cannot be quantified numerically. The vulnerability is not listed in the CISA KEV catalog and no public proof-of-concept code has been identified, suggesting real-world exploitation risk is currently limited. However, the 'easily exploitable' characterization from Oracle and the low authentication barrier (any valid database account suffices) elevate practical risk in multi-tenant or shared-hosting MySQL environments where untrusted users hold database credentials. The availability impact is classified as 'complete' by Oracle (hang or frequently repeatable crash), meaning successful exploitation results in sustained service disruption rather than a transient blip.

An attacker with any valid MySQL account - for example, a read-only application service account or a shared reporting user - connects to MySQL Server 9.7.0 or 9.7.1 over the standard TCP port and submits a crafted spatial/GIS query targeting the vulnerable GIS component. The malformed input triggers a hang or crash in the MySQL server process, causing a complete denial of service for all connected clients. Because Oracle describes this as 'frequently repeatable,' the attacker can sustain the outage by re-sending the payload after any automatic restart. No public proof-of-concept code has been confirmed at time of analysis.