This vulnerability allows an attacker with low privileges who can reach the MySQL services over the network to induce a repeatable crash or persistent hanging of the MySQL Server and MySQL Cluster. The flaw is located in the GIS component of the server and targets the availability of the database by causing a denial of service. The attacker does not need any special credentials beyond basic network reachability, and the impact is limited to service availability only, with no direct data exposure or integrity compromise reported.

Oracle MySQL products, specifically MySQL Server versions 9.7.0 to 9.7.1 and MySQL Cluster versions 9.7.0 to 9.7.1, are affected by this flaw. All deployments using these versions are susceptible unless a vendor-published fix or higher version is in use.

The CVSS score of 6.5 classifies this as a medium severity vulnerability, with a low exploitation difficulty and low privileges required, as reflected in the EPSS score below 1%. Attackers can exploit it from any network point that can communicate with MySQL’s various protocols. Although it is not listed in CISA’s KEV catalog, the flaw’s potential to take down production database services qualifies it as a significant threat for organizations reliant on continuous database availability. The lack of a user interaction requirement and the network-based entry means the vulnerability can be remotely triggered without any user involvement.