The vulnerability in MySQL Server and MySQL Cluster’s Optimizer component allows a high‑privileged attacker with network access through multiple protocols to trigger a crash, leading to a complete denial of service. The attacker can cause the database engine to hang or repeatedly crash, disrupting availability. The CVSS score of 4.9 (AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H) reflects moderate severity with network reachability, low attack complexity, and high privilege requirement, but no user interaction needed.

Oracle MySQL Server and MySQL Cluster are affected. For MySQL Server, versions 8.4.0 through 8.4.12, 9.7.0 through 9.7.3, and 26.7.0 through 26.7.1 are vulnerable. For MySQL Cluster, versions 8.0.0 through 8.0.49, 8.4.0 through 8.4.12, 9.7.0 through 9.7.3, and 26.7.0 through 26.7.1 must be inspected.

Because the attacker must have high privileges and the vulnerability requires network connectivity, it is moderately easy to exploit once the attacker has basic credentials or lateral movement. No EPSS score is available, and the vulnerability is not listed in CISA’s KEV, indicating it has not yet been reported as a widely used exploit. However, the ability to bring servers to a crash state makes it a high‑reliability risk for production databases, so security teams should monitor for abnormal query patterns and plan for swift recovery.