A bug in the Data Definition Language handling of Oracle MySQL Server can be triggered by a high‑privileged attacker with network access, allowing the server to crash or become unresponsive. The vulnerability is a pure availability flaw with no direct impact on confidentiality or integrity, and it can be invoked by any protocol that can send DDL commands. The advertised severity is a CVSS 3.1 score of 4.9, reflecting a moderate exploitation risk for Availability. The attacker would gain the ability to cause an application hang or a repeatable crash, resulting in service disruption for all clients.

Oracle Corporation’s MySQL Server product is affected. The vulnerable ranges are 8.0.0‑8.0.44, 8.4.0‑8.4.7 and 9.0.0‑9.5.0. Administrators should verify the exact build of Oracle MySQL Server they run and compare it to these ranges.

The exploit requires remote network connectivity and high‑privilege access to the MySQL Server, which limits the attack surface. The EPSS score of less than 1% indicates a very low probability of automatic exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. Attackers would target the service via the usual SQL interfaces, using privileged accounts to send malformed DDL commands. Given the moderate CVSS score and low EPSS, the overall risk is moderate but the likelihood of exploitation remains low unless attackers or automated tools specifically target this flaw.