ArcadeDB CVE-2026-75841

Exploitation requires a valid authenticated session with permission to execute Cypher queries against an ArcadeDB instance (PR:L per CVSS vector). The attacker must have credentials to submit queries - anonymous or unauthenticated access is insufficient. The range() function must be reachable through the Cypher interface, which is a standard ArcadeDB feature enabled by default. No non-default configuration is required beyond possessing a valid user account. Exploitation is limited to availability impact only (no confidentiality or integrity compromise), and impact is temporary - service typically recovers after JVM garbage collection or restart. Deployments that restrict Cypher access to fully trusted internal users are not meaningfully at risk.

The CVSS 4.0 score of 5.3 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N) reflects a medium-severity issue with a constrained real-world impact profile. The PR:L metric confirms exploitation requires authenticated access, which is the primary limiting factor - unauthenticated threat actors cannot weaponize this directly. The Availability impact is rated Low (VA:L), consistent with the described outcome of temporary service degradation rather than permanent data loss or corruption. No EPSS score was provided in the input data, so probabilistic exploitation likelihood cannot be quantified. No KEV listing and no public POC further reduce urgency. This vulnerability is best characterized as an availability risk from a malicious or compromised insider or authenticated external user, not a perimeter-level threat. The overall risk is real but contained to environments where untrusted authenticated users exist.

An authenticated database user - such as an application account, analyst, or compromised credential - submits a Cypher query containing range(0, 2147483647) or similarly large bounds to the ArcadeDB Cypher endpoint. The server attempts to materialize the full sequence in heap memory, rapidly exhausting available JVM heap and throwing an OutOfMemoryError, rendering the database temporarily unresponsive to all other users. No public POC was identified at time of analysis, but the technique is straightforward to derive from the description.