{
  "claim_outcome": "confirmed",
  "repro_result": "confirmed",
  "evidence_scope": "production_path",
  "observed_impact_class": "code_execution",
  "claimed_impact_class": "code_execution",
  "exploitability_confidence": "high",
  "attacker_controlled_input": "pure SQL statements from a USAGE-only account over TCP/3306: GRANT PROXY ... IDENTIFIED VIA '', LOAD DATA INFILE '/proc/self/maps', 128MiB user variable with baked JOP layout, CALL uaf5()",
  "trigger_path": "mariadb client -> TCP/3306 -> GRANT PROXY priv-esc (MDEV-40470) -> maps ASLR leak -> F-05 SYS_REFCURSOR UAF (sp_cursor_array::get_cursor_by_ref) -> Materialized_cursor::open() virtual dispatch -> JOP D2->D1 -> system()",
  "claimed_surface": "network_protocol",
  "validated_surface": "network_protocol",
  "end_to_end_target_reached": true,
  "sanitizer_used": false,
  "crash_observed": true,
  "read_write_primitive_observed": true,
  "exploit_chain_demonstrated": true,
  "accepted_exploit_knowledge_record_ids": [
    "c4f307bb-8926-47e3-ad1c-50e6aa917ca9",
    "dd215efe-4163-49dd-88d4-9fa5d314951a",
    "48a30dfb-cfb9-4f7c-a2c6-5183ce859172",
    "48128baa-ffcd-416f-8135-80f9dde09fb7"
  ],
  "inferred": false
}