CVE-2025-21520

What it actually does

The vulnerability in the Server Options component permits a high-privileged local attacker to obtain unauthorized read access to a limited subset of MySQL Server data under conditions requiring both difficult exploitation steps and interaction from a separate user.

Why it matters to the business

Low operational risk to database deployments because exploitation demands high privileges, physical or local infrastructure access, and coordinated human interaction, resulting in only minor potential exposure of non-sensitive data.

How an attack unfolds

An attacker first obtains high-privileged local logon to the host running MySQL, then relies on a second person to perform specific actions that trigger the flawed options handling path, ultimately allowing the attacker to read a restricted portion of accessible server data.

How to fix it

Upgrade affected MySQL Server installations to releases newer than 8.0.40, 8.4.3, and 9.1.0 as soon as Oracle publishes fixes; apply vendor patches promptly once available and restrict local administrative access in the interim.

How to confirm the fix worked

Confirm MySQL version numbers exceed the listed affected releases, review component option configurations for unintended exposure, and validate that local high-privileged sessions cannot read data without the required interaction conditions.

Typical attack path

1. Obtain high-privileged local logon to the MySQL Server host
2. Wait for or induce interaction from a separate authorized user
3. Trigger the Server Options component flaw to perform unauthorized read of a data subset

How to detect it

Examine host authentication logs and MySQL process activity for unusual local sessions initiated by privileged accounts, correlate with user interaction events around options configuration changes, and review audit trails for unexpected data access patterns.

What your security team should do

• Apply Oracle MySQL updates as soon as fixed versions are released
• Enforce least-privilege local access policies on database hosts
• Monitor Oracle advisory channels for patch availability and schedule rapid deployment