MySQL Shell EUVD-2026-24416

Exploitation requires: (1) local logon access to the infrastructure host where MySQL Shell executes, with at minimum a low-privileged OS account (PR:L, AV:L); (2) human interaction from a person other than the attacker (UI:R), meaning the attacker cannot autonomously trigger the vulnerability - a legitimate user's interaction with MySQL Shell is a necessary precondition. Exploitation is limited to the MySQL Shell client process and does not affect the MySQL server or other processes. Non-default configurations are not described as a prerequisite; any standard MySQL Shell deployment in the affected version range may be susceptible when the above conditions are met. Limiting factors: the local-only attack vector eliminates remote exploitation entirely; the mandatory human interaction requirement prevents automated or worm-style attacks; and impact is confined to crashing or hanging the shell client, with no lateral movement or data exposure possible from this vulnerability alone.

Real-world risk is low despite moderate CVSS scoring. The CVSS 3.1 base score of 5.0 reflects a local attack vector (AV:L), low complexity (AC:L), low-privilege requirement (PR:L), mandatory human interaction from a third party (UI:R), unchanged scope (S:U), and impact restricted solely to availability (A:H). EPSS at 0.01% (2nd percentile) is consistent with the SSVC assessment of 'Exploitation: none' and 'Automatable: no' - the combination of required local access and mandatory human interaction makes mass exploitation structurally impossible. The vulnerability is not listed in CISA KEV. Technical impact is rated 'partial' by SSVC, aligning with the tool-level (not server-level) scope of the crash. CVSS signals do not conflict with description-level signals in this case; all sources agree this is a local, user-interaction-dependent DoS against the shell client only. Priority for remediation should be low except in high-sensitivity environments where MySQL Shell is used interactively by untrusted low-privileged users.

A low-privileged local user with shell access to a host running MySQL Shell triggers a specific interaction pattern in the Core Client - such as submitting a malformed command or causing an edge-case session teardown - that exhausts or fails to release an internal resource, causing the MySQL Shell process to hang or crash. Because the attack requires human interaction from another user (UI:R), a realistic scenario involves an attacker manipulating a legitimate MySQL Shell user's session or environment to induce the crash, disrupting administrative operations. No public exploit code has been identified at time of analysis.