MySQL Cluster EUVD-2026-105927

Exploitation requires simultaneous physical access to a MySQL Cluster node (AV:P) and high-level/administrative privileges (PR:H) on that system, combined with high attack complexity (AC:H) indicating a non-trivial, specifically-conditioned trigger in the InnoDB component rather than a simple reproducible input. No user interaction is needed (UI:N). It applies to MySQL Cluster versions 8.0.0 through 8.0.37. These factors - physical presence plus existing privileged access plus difficult triggering conditions - sharply limit realistic exploitation to insiders or attackers who have already fully compromised the host, and the impact is confined to availability (service hang/crash) with no path to data compromise.

This is a genuinely low-priority issue despite being tracked as a CVE. The CVSS 3.1 base score of 3.8 (LOW) is corroborated across every available signal rather than contradicted by them. The vector (AV:P/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H) requires physical access to the system, high attack complexity, and high (administrative) privileges, while delivering only an availability impact (hang/repeatable crash) with no confidentiality or integrity loss. No EPSS score was provided in the input, there is no CISA KEV listing, and no public exploit code was identified, so all exploitation signals point the same direction: no public exploit identified at time of analysis. There is no conflict between signals here - the low CVSS, the DoS-only scope tag, and the absence of KEV/POC/EPSS data are mutually consistent. The combination of AV:P (physical) plus PR:H (already-privileged attacker) means an actor capable of exploiting this already holds physical and administrative control of the cluster node, drastically reducing real-world relevance. Note that the EUVD affected-version data and the Oracle CPU reference are confirmatory, but no CWE was assigned and no technical root-cause detail (specific InnoDB code path) is provided in the input.

An attacker who already has physical access to a MySQL Cluster data node and holds high database/OS privileges performs a difficult, carefully-conditioned sequence of operations against the InnoDB component that drives the node into a hang or repeatedly reproducible crash, producing a complete denial of service of MySQL Cluster. No public proof-of-concept exploit code was identified, and the high attack complexity (AC:H) implies the condition is not trivially triggered. There is no data disclosure or modification - impact is availability only.