CVE-2025-50087

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.0-8.0.42, 8.4.0-8.4.5 and 9.0.0-9.3.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all MySQL Server accessible data. CVSS 3.1 Base Score 4.9 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N).

A moderate-impact vulnerability was found in the MySQL Server Optimizer component as shipped in Red Hat Enterprise Linux and Fedora. The flaw allows a remote attacker who already holds high privileges on the database and has network access via multiple protocols to gain unauthorized ability to create, delete, or modify critical data or all data accessible to the MySQL Server. Only integrity is affected; there is no impact on confidentiality or availability, and exploitation requires an already highly privileged account. Red Hat rates this flaw Moderate, matching the upstream severity of CVSS 3.1 base score 4.9 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N); there is no meaningful difference from the upstream assessment.

Red Hat Enterprise Linux 8 (mysql:8.0), Red Hat Enterprise Linux 9 (mysql and mysql:8.4), and Red Hat Enterprise Linux 10 (mysql8.4) are affected, and fixes for these products are being pursued through the standard Red Hat update process. Red Hat Enterprise Linux 6 Extended Lifecycle Support is not affected because the vulnerable code is not present in the mysql package shipped for that stream. Red Hat In-Vehicle OS is tracked within this flaw's scope under a delegated assessment that recorded its mysql package as not affected. For Fedora, which distributes the affected mysql8.0 and mysql8.4 community packages, the fix has been deferred, and affected systems remain exposed until a future package update delivers the fix.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Fixes for the affected Red Hat Enterprise Linux mysql packages are delivered through the standard Red Hat update process, and users should apply the available updates.