The vulnerability is a stack‑based buffer overflow that occurs when libsnowflakeclient or the Snowflake PHP PDO Driver copies a value from an identity provider’s HTML response into a fixed‑size buffer without length validation during a SAML SSO login. The overflow can corrupt memory and, in certain conditions, allow an attacker who controls the identity provider or redirects the SAML endpoint to a malicious server to trigger a crash or execute code within the context of the running application.

The affected vendors are Snowflake, with the product snowflake client library and the Snowflake PHP PDO Driver. Versions prior to libsnowflakeclient 2.11.1 and Snowflake PHP PDO Driver 4.3.0 are vulnerable.

The CVSS score of 6.6 indicates a moderate severity. EPSS data is not available, and the issue is not listed in the CISA KEV catalog. Exploitation requires the attacker to supply an oversized SAML response, so the attack vector is limited to scenarios where the identity provider can be compromised or spoofed. When the vector succeeds, memory corruption may lead to a crash or remote code execution in the context of the application using the library.