MySQL Shell EUVD-2026-24420

Exploitation requires a low-privileged local OS account on the host where MySQL Shell is running (AV:L/PR:L) - remote exploitation is not possible. Additionally, human interaction from a person other than the attacker is required (UI:R); the precise nature of this interaction is not specified in available data, but it must come from a separate legitimate user. These two prerequisites together prevent autonomous, remote, or single-actor exploitation. Exploitation is bounded to availability impact only (crash or hang of the MySQL Shell process); no confidentiality or integrity compromise is possible. SSVC confirms Automatable:no, meaning scalable automated exploitation is not feasible. The most significant real-world limiter is the combination of local-only access and mandatory victim interaction.

Every available signal converges on low real-world urgency. The CVSS 3.1 score of 5.0 (Medium) is already constrained by AV:L, PR:L, and UI:R, reflecting that neither remote nor unauthenticated nor autonomous exploitation is possible. EPSS at 0.01% (2nd percentile) indicates virtually no observed exploitation activity in the wild. SSVC corroborates this: Exploitation:none, Automatable:no, Technical Impact:partial. The vulnerability is absent from CISA KEV and no POC has been identified. The UI:R requirement is a meaningful real-world limiter - a legitimate user must interact with the shell in an unspecified way for the crash to trigger, making this impractical to exploit opportunistically. Impact is limited exclusively to availability (crash/hang of the shell process itself); there is no confidentiality or integrity exposure. This is a genuine but low-urgency operational risk, appropriate to address within Oracle's standard quarterly CPU patching window rather than through emergency out-of-band action.

A low-privileged attacker who has already obtained local logon access to a database administration host running MySQL Shell crafts a specific input sequence targeting the Core Client's observable response discrepancy. The attacker induces a legitimate user - such as a DBA actively using the shell - to trigger the vulnerable code path, causing MySQL Shell to hang or crash repeatedly. No public exploit code exists for this vulnerability, and replication would require local access and victim interaction.