CVE-2026-71073 Overview
CVE-2026-71073 affects the Oracle MySQL Connectors product, specifically the Connector/ODBC component in version 26.7.0. The vulnerability allows an unauthenticated local attacker to trigger a hang or repeatable crash of the MySQL Connectors process, resulting in a complete denial-of-service condition. Exploitation requires interaction from a user other than the attacker, such as opening or processing an attacker-controlled input through the ODBC driver. The flaw does not impact confidentiality or integrity, but availability loss is total for the affected process.
Critical Impact
A local attacker can crash or hang MySQL Connector/ODBC 26.7.0, causing complete denial of service for applications relying on the driver.
Affected Products
- Oracle MySQL Connectors 26.7.0
- Component: Connector/ODBC
- Applications and services embedding the affected ODBC driver
Discovery Timeline
- 2026-08-18 - CVE-2026-71073 published to the National Vulnerability Database
- 2026-08-20 - Last updated in NVD database
Technical Details for CVE-2026-71073
Vulnerability Analysis
The vulnerability resides in the Oracle MySQL Connector/ODBC component of MySQL Connectors 26.7.0. An attacker with local access to the infrastructure running the connector can supply crafted input that the driver fails to process safely. When a legitimate user interacts with that input, the driver enters an unrecoverable state and either hangs or crashes.
The issue is classified as a Denial of Service condition. Confidentiality and integrity are not affected, but availability impact is high because the process becomes unusable until restarted. Any downstream application that depends on the ODBC driver for MySQL connectivity inherits the outage.
Root Cause
Oracle has not published detailed root-cause information in the referenced advisory. Based on the impact profile and the requirement for user interaction, the flaw is consistent with improper input handling in the driver's parsing or connection logic that leads to a crash or infinite loop. See the Oracle Security Alert for vendor-provided details.
Attack Vector
The attack vector is local. An attacker must have logon access to the infrastructure where MySQL Connectors executes. No authentication or privileges within the connector are required. The attacker prepares malicious data, configuration, or a data source that another user then interacts with through the ODBC driver. That interaction triggers the crash or hang, completing the denial-of-service outcome.
Exploitation code is not required for reliable triggering, and no public proof-of-concept has been reported. The EPSS probability remains low, reflecting the local vector and interaction requirement.
Detection Methods for CVE-2026-71073
Indicators of Compromise
- Unexpected termination or hang of processes loading the MySQL Connector/ODBC driver on hosts running version 26.7.0.
- Repeated application crashes correlated with ODBC data source access from a specific local user account.
- Malformed DSN (Data Source Name) configurations or unusual connection strings written to odbc.ini or the Windows registry under HKLM\SOFTWARE\ODBC.
Detection Strategies
- Monitor Windows Event Log and Linux journald for application faults referencing myodbc modules or ODBC driver manager crashes.
- Alert on repeated non-zero exit codes from processes linked against the MySQL ODBC library.
- Correlate local user session activity with driver crash timestamps to identify suspicious triggering patterns.
Monitoring Recommendations
- Track modifications to ODBC DSN configuration files and registry keys by non-administrative users.
- Baseline normal ODBC connection frequency and alert on sudden spikes in failures or restarts.
- Log driver version telemetry across the fleet to identify hosts still running the vulnerable 26.7.0 release.
How to Mitigate CVE-2026-71073
Immediate Actions Required
- Inventory all systems running Oracle MySQL Connector/ODBC 26.7.0 and prioritize them for patching.
- Restrict local logon rights on hosts where the connector executes to reduce the pool of potential attackers.
- Review ODBC data source configurations and remove any created by untrusted users.
Patch Information
Apply the fixes referenced in the Oracle Security Alert for August 2026. Upgrade Connector/ODBC to the version identified by Oracle as containing the fix, and validate driver versions across all application servers and workstations after deployment.
Workarounds
- Limit interactive and remote logon rights on systems hosting the affected driver until patches are applied.
- Enforce strict file-system and registry ACLs on ODBC configuration paths to prevent tampering by low-privilege users.
- Implement process supervision to automatically restart critical services that depend on the ODBC driver after a crash.
# Configuration example: restrict write access to ODBC configuration on Linux
sudo chown root:root /etc/odbc.ini /etc/odbcinst.ini
sudo chmod 644 /etc/odbc.ini /etc/odbcinst.ini
# Verify installed Connector/ODBC version
odbcinst -q -d -n "MySQL ODBC 26.7 Unicode Driver"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
