MySQL Server EUVD-2026-106019

Exploitation requires the attacker to already hold a high-privileged MySQL account (PR:H) and network reachability to the database over one of MySQL's supported protocols; impact is confined to the InnoDB storage engine and results only in a hang or frequently repeatable crash (complete DoS), with no confidentiality or integrity effect. Realistic exploitation is significantly limited by three factors: the high privilege prerequisite (a trusted/administrative DB user), the high attack complexity (Oracle explicitly calls it 'difficult to exploit,' implying non-deterministic or state-dependent triggering), and the lack of any confidentiality or integrity impact that would motivate a privileged insider. This affects MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1 and MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1.

This is a genuinely low-priority issue despite the MySQL ubiquity, and the signals are internally consistent. The CVSS 3.1 vector (AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H, base 4.4 MEDIUM) describes an availability-only (DoS) flaw that is explicitly 'difficult to exploit' (AC:H) and requires an already high-privileged account (PR:H) - meaning the attacker must essentially be a trusted/administrative database user before they can trigger a hang or repeatable crash. No EPSS score, CISA KEV listing, or public POC is present in the provided intelligence, so there is no evidence of exploitation probability or active abuse. The combination of high attack complexity, high required privileges, and impact limited solely to availability means that even though MySQL is deployed nearly everywhere, the realistic attack surface is small: an adversary with PR:H already has legitimate database administrative power and little incentive to merely crash the server. There are no conflicting signals here - all data points toward a low-urgency, defense-in-depth patch rather than an emergency. The only gap is the absence of EPSS/KEV/POC data, which is expected this early for an Oracle CPU advisory and should be re-checked after publication.

An attacker who has already obtained high-privileged MySQL credentials (e.g., a rogue or compromised DBA/service account) connects over the network via one of MySQL's supported protocols and issues a specially crafted sequence against the InnoDB engine that triggers a hang or repeatable crash, producing a complete denial of service. Because exploitation is rated high-complexity (AC:H), it likely depends on winning a race or hitting a specific state rather than a single deterministic request. No public exploit code has been identified at time of analysis.