Oracle MySQL Server EUVD-2026-106148

Exploitation requires the attacker to hold valid low-privileged credentials for the target (PR:L) and network reachability to the MySQL Server or Cluster service over one of its supported protocols; the flaw resides in the InnoDB storage engine. No special non-default configuration is named in the description - any affected version running InnoDB (the default MySQL storage engine) is in scope. The primary limiting factor is the authentication requirement: the attacker must already be an authenticated database user, which excludes fully anonymous external attackers and confines realistic risk to insiders, compromised application accounts, or deployments granting database logins to untrusted parties. Affected: MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1.

This is a genuine but bounded-priority issue. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) describes an easily exploitable, network-reachable flaw requiring only low privileges and no user interaction, with impact limited exclusively to availability (C:N/I:N) - a complete denial of service (hang or repeatable crash) of the database engine. The 6.5 Medium score reflects that there is no confidentiality or integrity exposure; this is not a code-execution or data-breach bug. No EPSS score, CISA KEV listing, or public POC was provided in the input, so there is no signal of active or probable exploitation - exploitation status is 'no public exploit identified at time of analysis.' The PR:L requirement is the key mitigating factor: an attacker must already hold valid (even if low-privileged) MySQL credentials or network-authenticated access, which contains the threat largely to insiders, compromised application accounts, or environments exposing MySQL to untrusted authenticated users. No signals are directly conflicting, but note that EPSS/KEV/POC data is simply absent rather than confirmed-negative, so real-world exploitation likelihood cannot be quantified from this input. Treat as a standard Oracle CPU patch-cycle item: important for availability-sensitive database deployments, but not an emergency relative to code-execution CVEs.

An attacker holding low-privileged but valid MySQL credentials (for example, a compromised application service account) connects over the network via one of the supported protocols and issues a crafted query or sequence that triggers a fault in the InnoDB storage engine, causing the server to hang or repeatedly crash. This yields a complete denial of service of the MySQL Server or Cluster node. No public exploit code was identified in the provided data, and the attack requires prior authentication.