MySQL Server EUVD-2026-106018

Exploitation requires an authenticated, high-privileged MySQL account (CVSS PR:H) with network reachability to the server over one of MySQL's supported protocols; the attacker then sends a crafted query that triggers a defect in the Server: Optimizer query-planning component, causing a hang or repeatable crash. Limiting factors: the high-privilege account requirement excludes unauthenticated and least-privilege/application users, there is no confidentiality or integrity impact, and affected versions are specific (MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1). No special non-default configuration or user interaction is required beyond holding privileged credentials.

This is a moderate, availability-only issue (CVSS 3.1 4.9, vector AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H) whose real-world risk is substantially capped by its privilege requirement. The vector cleanly supports a network-reachable, low-complexity attack with no user interaction, but PR:H means the attacker must already hold a high-privileged MySQL account, which excludes anonymous remote actors and most least-privilege application accounts. Impact is confined to availability (complete DOS via hang or repeatable crash); there is no confidentiality or integrity loss. No EPSS score, CISA KEV listing, POC, or SSVC decision data was provided in the input, so exploitation likelihood cannot be quantified from these sources - consistent with no public exploit identified at time of analysis. Oracle's own text calls it 'easily exploitable,' which aligns with AC:L, but 'easily exploitable' refers to technical ease once the privilege precondition is met, not to ease of obtaining that privilege. Net: a legitimate patch-management priority on multi-tenant or shared database servers where privileged accounts are numerous or semi-trusted, but a low-urgency, contain-via-least-privilege issue on single-tenant deployments. Severity classification should not be inflated beyond the availability-only, high-privilege reality.

An attacker possessing a high-privileged MySQL account (e.g., a semi-trusted DBA on a shared/multi-tenant server) connects over the network via one of the supported protocols and submits a specially crafted query that exercises a flaw in the Server: Optimizer component. The malformed optimization path causes the server to hang or repeatedly crash, producing a complete denial of service for all tenants/applications. No public exploit code was identified in the provided data.