The flaw occurs in the InnoDB storage engine of Oracle MySQL Server and is a combination of broken access control (CWE-284) and an out‑of‑bounds write (CWE-770). A high‑privileged attacker who can reach the database over the network can trigger a hang or a repeatable crash. Successful exploitation stops the MySQL service entirely, forcing a manual restart or reboot and denying all legitimate database operations.

Oracle MySQL Server versions that include the InnoDB component are impacted. The affected range is 8.0.0 through 8.0.45, 8.4.0 through 8.4.8, and 9.0.0 through 9.6.0. Users should verify that their installations fall within these intervals.

The CVSS v3.1 base score of 4.9 indicates a moderate availability impact. The EPSS score is 0.0004, reflecting a very low probability of exploitation, and the vulnerability is not listed in CISA KEV, so no widespread exploitation is currently documented. The attack vector is inferred to be network‑based; a MySQL instance reachable over any supported protocol provides the opportunity required. Although the attacker must have high privileges, the ease of exploitation is described as high, meaning that once the attacker has sufficient access, the crash can be reliably triggered. Overall, the risk is moderate but significant for services that rely on continuous database availability.