Description
The mysqlnd wire protocol parser reads fields out of server packets before checking that the packet still holds enough bytes for them. A malicious or compromised MySQL server can send a truncated packet and make the client read past the end of the packet buffer, which is undefined behaviour and can crash the process.
Published: 2026-09-25
Score: 3.4 Low
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service through client crash
Action: Patch
AI Analysis

Impact

The bug in mysqlnd_writeprotocol.c allows a MySQL server to send a truncated packet that the PHP client parses without first verifying the packet length. This causes undefined behavior and can crash the PHP process. The consequence is a local denial of service, with no evidence of code execution or data exfiltration.

Affected Systems

The affected product is the PHP Group’s PHP implementation, specifically the mysqlnd driver used for MySQL communication. The input does not specify particular PHP releases, so any PHP installation that employs mysqlnd could be vulnerable until a patch is applied.

Risk and Exploitability

With a CVSS score of 3.4 the vulnerability is considered low severity. The EPSS score is not reported and the issue is not listed in the CISA KEV catalog. The attack requires a malicious or compromised MySQL server that can send crafted packets to the PHP client, or an attacker who can manipulate network traffic between the MySQL server and the PHP application. Exploitation results in a crash rather than code execution, but repeated crashes could be used in a denial‑of‑service scenario.

Generated by OpenCVE AI on September 26, 2026 at 01:19 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade to the latest PHP release that contains the mysqlnd overread fix.
  • If an immediate upgrade is not possible, consider temporarily disabling mysqlnd and using an alternative MySQL driver such as libmysqlclient.
  • Enable network monitoring or packet inspection to detect abnormal truncated packets from MySQL servers and log any resulting process crashes for investigation.

Generated by OpenCVE AI on September 26, 2026 at 01:19 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DLA Debian DLA DLA-4819-1 php8.2 security update
Debian DSA Debian DSA DSA-6514-1 php8.4 security update
History

Mon, 28 Sep 2026 14:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Sat, 26 Sep 2026 08:45:00 +0000

Type Values Removed Values Added
First Time appeared Php Group
Php Group php
Vendors & Products Php Group
Php Group php

Sat, 26 Sep 2026 00:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-125
References
Metrics threat_severity

None

 threat_severity

Low

Fri, 25 Sep 2026 21:00:00 +0000

Type Values Removed Values Added
Description The mysqlnd wire protocol parser reads fields out of server packets before checking that the packet still holds enough bytes for them. A malicious or compromised MySQL server can send a truncated packet and make the client read past the end of the packet buffer, which is undefined behaviour and can crash the process.
Title Various packet overreads in mysqlnd_writeprotocol.c
Weaknesses CWE-122
References
Metrics cvssV3_1

{'score': 3.4, 'vector': 'CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N'}

Subscriptions

Php Group Php
cve-icon MITRE

Status: PUBLISHED

Assigner: php

Published:

Updated: 2026-09-28T13:31:31.774Z

Reserved: 2025-02-11T04:49:52.603Z

Link: CVE-2025-1218

cve-icon Vulnrichment

Updated: 2026-09-28T13:24:46.726Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-09-25T21:17:20.993

Modified: 2026-10-14T13:10:00.187

Link: CVE-2025-1218

cve-icon Redhat

Severity : Low

Publid Date: 2026-09-25T20:48:21Z

Links: CVE-2025-1218 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-09-26T08:30:02Z

Weaknesses