MySQL Server EUVD-2026-46580

Exploitation requires a valid low-privileged MySQL database account with network access to the target MySQL Server or MySQL Cluster instance running versions 9.7.0 or 9.7.1. The CVSS vector PR:L confirms that at least some level of database authentication is required - unauthenticated exploitation is not supported by the available data. No special configuration, elevated role, or non-default feature flag is described as a prerequisite; a standard low-privilege account (e.g., SELECT-only) appears sufficient per Oracle's description of 'low privileged attacker.' Multiple protocols are stated as viable attack vectors, so network filtering on a single port is insufficient if multiple MySQL protocol listeners are exposed. Exploitation is limited by version - only the 9.7.x branch is affected - and by the requirement for at least minimal authenticated access, which rules out entirely anonymous or unauthenticated attacks from the public internet.

The CVSS 3.1 score of 6.5 (Medium) reflects network reachability with low complexity and low privileges, but only availability impact and no scope change. In practice, this is a meaningful operational risk for any environment exposing MySQL to untrusted low-privileged users - including multi-tenant databases, shared hosting, SaaS backends, or developer environments with broad account grants. The attack is described as 'easily exploitable' and 'frequently repeatable,' meaning an attacker can sustain a DoS condition reliably, not just trigger an isolated crash. No EPSS score was provided, no CISA KEV listing was found, and no public proof-of-concept has been identified, which collectively suggest limited observed exploitation at this time. The restricted version range (9.7.0-9.7.1 only) limits scope to recent deployments; operators running 9.6.x or earlier are unaffected. Risk is moderate-to-high for affected deployments hosting untrusted or semi-trusted database users; lower for deployments where all credential holders are fully trusted.

An attacker holding a low-privileged MySQL account - such as a read-only application service account, a shared developer credential, or an account obtained via credential stuffing - connects to the MySQL Server or Cluster instance over the network and submits a specially crafted SQL query targeting the Optimizer component. The Optimizer fails to handle the input correctly, causing the mysqld process to hang or crash. Because the crash is 'frequently repeatable,' the attacker can resubmit the query immediately after any automatic restart, sustaining a persistent DoS against the database service. No public proof-of-concept is known at time of analysis.