CVE-2016-6662: MySQL, MariaDB and Percona Server local privilege escalation via general_log_file

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

critical priorityCVSS 9.8 with a documented path to root code execution and a very high EPSS score, though exploitation requires local access.

What it is

MySQL, MariaDB and Percona Server allow a local user to set general_log_file to a my.cnf configuration path, creating arbitrary configuration files and bypassing protection mechanisms. The flaw can be leveraged to execute arbitrary code with root privileges by setting malloc_lib, making it a serious local privilege escalation on database hosts.

Impact

An attacker with local access gains the ability to write arbitrary configuration and, per the advisory, execute code as root. This effectively yields full control of the database host.

Attack surface

The flaw is reached locally by a user able to influence the general_log_file setting; the CVSS vector is network-based with no privileges or user interaction, but the description and advisory frame it as a local-user issue. No authentication or user interaction is required per the vector.

Exploitation

Not listed in CISA KEV and no ransomware associations are documented; EPSS is high at 0.6773 (99.28th percentile), and references include a third-party advisory describing remote root code execution and privilege escalation.

What to do

• Apply vendor patches: Oracle October 2016 CPU, MariaDB 5.5.51/10.0.27/10.1.17, Percona 5.5.51-38.1/5.6.32-78.0/5.7.14-7, and relevant Red Hat, Debian and Gentoo errata.
• Restrict local shell and database account access on database hosts to trusted administrators only.
• Ensure my.cnf and configuration directories are owned by root and not writable by the mysql user or other local users.
• Audit and remove unnecessary FILE and SUPER privileges from non-administrative database accounts.
• Monitor for unexpected changes to my.cnf and other MySQL/MariaDB configuration files.

Detection

• Alert on modifications to my.cnf or other MySQL/MariaDB configuration files outside change windows.
• Monitor for general_log_file being set to paths outside expected log directories.
• Watch for unexpected child processes or library loads (malloc_lib) spawned by the database service.
• Review database audit logs for local accounts altering logging or configuration variables.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.