CVE-2025-30721

What it actually does

Local high-privileged attacker with logon access can trigger a hang or repeatable crash in MySQL Server via the Server: UDF component when a second user performs specific actions.

Why it matters to the business

Successful exploitation causes complete loss of database availability, resulting in unplanned downtime for applications and services that rely on the affected MySQL instances.

How an attack unfolds

An attacker with administrative logon to the host running an affected MySQL version crafts or supplies a malicious UDF, waits for a second user to interact with the server, and leverages the race or interaction condition to force the server process into a hang or crash state.

How to fix it

Upgrade MySQL Server to a version beyond 8.0.41, 8.4.4 or 9.2.0 as appropriate for the release line. For Mageia 8 systems apply the listed fixed packages: kernel 5.10.75-1.mga8, kmod-virtualbox 6.1.28-1.2.mga8 and kmod-xtables-addons 3.18-1.25.mga8.

How to confirm the fix worked

Confirm the running MySQL version is newer than the affected ranges, review change logs for UDF-related fixes, and test that the server remains stable under the previously triggering interaction sequence.

Typical attack path

1. Obtain high-privileged local access to the MySQL host
2. Place or register a specially crafted user-defined function
3. Trigger interaction from another user account on the same instance
4. Cause the server to enter a hung or crashed state resulting in denial of service

How to detect it

Review MySQL error logs and system logs around the time of unexpected server restarts or hangs for UDF-related entries; correlate with authentication events showing multiple privileged sessions on the host.

What your security team should do

• Prioritize patching production MySQL instances to the fixed versions within the next maintenance window
• Restrict local administrative access to MySQL hosts to the minimum necessary personnel
• Monitor for any unusual UDF registrations or repeated server restarts in database logs