MySQL Server EUVD-2026-106188

Exploitation requires the attacker to already hold a HIGH-privileged MySQL account (PR:H) and network reachability to the server over one of MySQL's supported protocols; no user interaction is needed (UI:N) and attack complexity is low (AC:L) once authenticated. The flaw resides in the Server: Optimizer component, so the triggering action is a query that exercises the vulnerable optimizer code path. Key limiting factor: the high-privilege prerequisite means this is not remotely exploitable by anonymous or low-privileged users - it is primarily a risk from insiders or from an account that has already been compromised. Impact is confined to availability (service hang/repeatable crash); no data is exposed or modified. Affected: MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1 and MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1.

This is a genuinely low-to-moderate priority issue despite the 'easily exploitable' phrasing in Oracle's advisory. The CVSS 3.1 base score of 4.9 (MEDIUM) is driven entirely by availability impact (A:H), with no confidentiality or integrity exposure (C:N/I:N). The vector (AV:N/AC:L/PR:H/UI:N/S:U) confirms network reachability and low attack complexity, but critically requires HIGH privileges (PR:H) - meaning the attacker must already hold a highly privileged MySQL account. This privilege barrier sharply limits real-world risk: an attacker able to authenticate with high privileges can cause a complete DoS (hang or repeatable crash) of the server, but cannot read or alter data. There is no KEV listing, no EPSS score provided in the input, and no public exploit identified, so there is no evidence of active exploitation. The 'easily exploitable' label from Oracle refers to attack complexity (AC:L) once the privilege precondition is met, not to ease of obtaining access - do not conflate these. Net assessment: a legitimate patch-management item, but not an emergency given the high-privilege requirement and availability-only impact.

An attacker who has already obtained high-privileged credentials on a MySQL Server or Cluster instance connects over the network via a supported protocol and issues a crafted query that triggers a flaw in the Optimizer component, causing the server to hang or crash in a repeatable manner (complete DoS). No public exploit code has been identified at time of analysis, and the attack yields no data disclosure or modification - only service disruption.