An attacker who can log on to the host where MySQL Shell runs can trigger a crash or hang in the Shell component, resulting in a complete denial of service. The flaw is a local, low‑privilege vulnerability that does not grant elevated privileges or data disclosure but can bring the Shell process to an unresponsive state. The CVSS base score of 5.0 reflects an impact on availability only, with an attack vector of local access and required user interaction.

The vulnerability is present in Oracle MySQL Shell for all supported releases from 8.0.0 to 8.0.45, 8.4.0 to 8.4.8, and 9.0.0 to 9.6.0. All installations of the Shell running under these versions are potentially affected.

Because the flaw requires an attacker to run commands locally within MySQL Shell and an additional human to trigger the crash, the likelihood of successful exploitation is limited to environments where an attacker can obtain logon access. The EPSS score of <1% indicates a very low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog, indicating no known widespread exploitation. The moderate CVSS score suggests some risk to local availability, but the attack requires user interaction beyond the initial attacker, reducing overall exploitation probability.