MySQL Server EUVD-2026-106133

Exploitation requires the attacker to already possess high database privileges on the target (CVSS PR:H) - this is the primary limiting factor and restricts the viable attacker set to privileged insiders or adversaries who have already obtained high-privilege credentials. Given that, the attacker needs network reachability to the MySQL service over one of multiple supported protocols (AV:N) and sends crafted input that exercises the Server: Optimizer component; no end-user interaction is required (UI:N) and attack complexity is low (AC:L). Affected deployments are MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1 and MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; the description cites no special non-default configuration or feature flag, so the main realistic brake on exploitation is the high-privilege prerequisite rather than deployment mode. Impact is limited to a complete availability loss (hang/crash) with no data exposure.

This is a moderate, availability-only issue (CVSS 3.1 base 4.9) that should be treated as a low-to-medium real-world priority despite affecting an ubiquitous product. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H shows network vector and low attack complexity, but critically requires high privileges (PR:H) - the attacker must already be a highly privileged database user, which sharply limits the realistic attacker population to insiders or those who have already compromised privileged credentials. Impact is confined to availability (C:N/I:N/A:H): a complete denial of service (hang or repeatable crash) with no confidentiality or integrity loss. No EPSS score was provided in the input; this CVE is NOT in CISA KEV and no public exploit code is referenced, so there is no evidence of active exploitation or weaponization. The 'easily exploitable' language in the Oracle description reflects the AC:L rating but is bounded by the PR:H requirement. Net: a genuine but contained DoS risk - real fix-worthy issue for internet-exposed or multi-tenant MySQL deployments, not an emergency. No signals conflict; the description and CVSS vector are consistent.

An attacker who already holds high database privileges (e.g., a malicious insider, a compromised application service account, or a low-trust tenant in a shared MySQL environment) connects over the network via a supported protocol and issues specially crafted queries that trigger a flaw in the Server Optimizer component. The malformed optimizer input causes the server to hang or repeatedly crash, producing a complete denial of service for all users. No public proof-of-concept or exploit code is identified at time of analysis.