CVE-2026-101771
Awaiting Analysis Awaiting Analysis - Queue

Heap-based Buffer Overflow in MySQL Server

Publication date: 2026-10-20

Last updated on: 2026-10-30

Assigner: Oracle

Description
Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Client programs). Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster. Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-20
Last Modified
2026-10-30
Generated
2026-11-10
AI Q&A
2026-10-21
EPSS Evaluated
2026-11-08
NVD
CVE-2026-101771
EUVD
EUVD-2026-106172

Affected Vendors & Products

Showing 7 associated CPEs
Vendor Product Version / Range
oracle mysql_cluster From 26.7.0 (inc) to 26.7.1 (inc)
oracle mysql_cluster From 8.0.0 (inc) to 8.0.49 (inc)
oracle mysql_cluster From 8.4.0 (inc) to 8.4.12 (inc)
oracle mysql_cluster From 9.7.0 (inc) to 9.7.3 (inc)
oracle mysql_server From 26.7.0 (inc) to 26.7.1 (inc)
oracle mysql_server From 8.4.0 (inc) to 8.4.12 (inc)
oracle mysql_server From 9.7.0 (inc) to 9.7.3 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-284 The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a vulnerability in MySQL Server and MySQL Cluster where an unauthenticated attacker can remotely exploit it through network access. It allows full takeover of the affected systems due to its high impact on confidentiality, integrity, and availability.

Detection Guidance

Detecting this vulnerability requires checking the installed MySQL Server or MySQL Cluster version against the affected versions. Use commands like 'mysql --version' or 'mysqld --version' to check the version. Compare the output with the affected ranges: MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1.

Impact Analysis

If you use MySQL Server versions 8.4.0-8.4.12, 9.7.0-9.7.3, or 26.7.0-26.7.1, or MySQL Cluster versions 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3, or 26.7.0-26.7.1, an attacker could gain control of your database, leading to data theft, corruption, or service disruption.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR and HIPAA requirements for data protection and confidentiality. Non-compliance risks include legal penalties and reputational damage.

Mitigation Strategies

Immediately upgrade MySQL Server or MySQL Cluster to a version outside the affected range. Apply the latest patches from Oracle. If upgrading is not possible, restrict network access to the MySQL ports (default 3306) using firewalls or disable remote access until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-101771. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...