MySQL Server EUVD-2026-106030

Exploitation requires an attacker who already holds HIGH database privileges on the target (PR:H) and network reachability to the MySQL Server or MySQL Cluster instance over one of its supported protocols. The flaw resides in the InnoDB storage engine. Affected builds are MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3, and 26.7.0-26.7.1, and MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3, and 26.7.0-26.7.1. No user interaction is needed (UI:N). The key LIMITING factor is the privilege requirement: this cannot be exploited by an unauthenticated or low-privilege user, so it is primarily an insider/post-compromise risk. Impact is confined to availability (hang or repeatable complete DOS); there is no path to data access or modification.

This is a genuine but modest-priority issue, best characterized as a high-privilege denial-of-service rather than a critical threat. The CVSS 3.1 base score is 4.9 (Medium) with vector AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H, meaning network-reachable and low-complexity, but gated behind PR:H - the attacker must already hold high database privileges. Impact is availability-only (C:N/I:N/A:H): a hang or repeatable crash producing complete DOS of the MySQL Server/Cluster instance, with no confidentiality or integrity loss. No EPSS score was supplied in the input, and there is no CISA KEV listing and no POC reference, so exploitation signals are absent - status is 'no public exploit identified at time of analysis.' Oracle's own description labels it 'easily exploitable,' which aligns with AC:L, but the PR:H requirement sharply limits the realistic threat population to insiders or attackers who have already compromised privileged credentials. There is a mild tension worth verifying: the description says exploitation is possible 'via multiple protocols' with network access, yet it still demands high privileges, so this is not a pre-auth remote crash. No SSVC decision data was provided. Net: patch in normal Oracle CPU cadence; this is not a high-CVSS-but-low-risk mislabel, it is a correctly-scored Medium whose real-world urgency is tempered by the high-privilege precondition and the availability-only impact.

An attacker who has already obtained high-privilege MySQL credentials (e.g. a malicious DBA, a compromised application service account, or an insider) connects over the network via one of MySQL's supported protocols and issues crafted operations against the InnoDB engine that trigger a hang or repeatable crash, taking the database offline. No public exploit code or active exploitation has been identified, and the attack produces only denial of service - no data disclosure or modification.