CVE-2025-1218
published 2026-09-25CVE-2025-1218: The mysqlnd wire protocol parser reads fields out of server packets before checking that the packet still holds enough bytes for them. A malicious or…
PriorityP430medium5.9CVSS 3.1
AVNACHPRNUINSUCNINAH
EPSS
0.28%
20.6th percentile
The mysqlnd wire protocol parser reads fields out of server packets before checking that the packet still holds enough bytes for them. A malicious or compromised MySQL server can send a truncated packet and make the client read past the end of the packet buffer, which is undefined behaviour and can crash the process.
Affected
21 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | php8.4 | — | — |
| php | php | — | — |
| php | php | >= 8.2.0 < 8.2.34 | 8.2.34 |
| php | php | >= 8.3.0 < 8.3.35 | 8.3.35 |
| php | php | >= 8.4.0 < 8.4.26 | 8.4.26 |
| php | php | >= 8.5.0 < 8.5.11 | 8.5.11 |
| php_7.4 | php | — | — |
| php_8.2 | php | — | — |
| php_8.3 | php | — | — |
| php_8.4 | php | — | — |
| php_group | php | >= 8.2.* < 8.2.34 | 8.2.34 |
| php_group | php | >= 8.3.* < 8.3.35 | 8.3.35 |
| php_group | php | >= 8.4.* < 8.4.26 | 8.4.26 |
| php_group | php | >= 8.5.* < 8.5.11 | 8.5.11 |
| ubuntu | php5 | — | — |
| ubuntu | php7.0 | — | — |
| ubuntu | php7.2 | — | — |
| ubuntu | php7.4 | — | — |
| ubuntu | php8.1 | — | — |
| ubuntu | php8.3 | — | — |
| ubuntu | php8.5 | — | — |
CVSS provenance
nvdv3.15.9MEDIUMCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
vendor_redhat3.4LOW
vendor_ubuntu3.4LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
PHP vulnerabilities
vendor_ubuntu·2026-10-19·CVSS 3.4
CVE-2026-93682 [LOW] PHP vulnerabilities
Title: PHP vulnerabilities
Summary: Several security issues were fixed in PHP.
It was discovered that PHP did not properly validate the size of MySQL
server packets in the mysqlnd driver. A malicious server could possibly use
this issue to cause PHP to crash, resulting in a denial of service. This
issue was only addressed in Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu
24.04 LTS, Ubuntu 26.04 LTS, and Ubuntu 26.10. (CVE-2025-1218)
It was discovered that PHP incorrectly handled response buffer sizes in the
SOAP HTTP client. A malicious server could possibly use this issue to cause
PHP to crash, resulting in a denial of service, or execute arbitrary code.
(CVE-2025-14181)
It was discovered that PHP incorrectly handled certain TAR archive headers
in the Phar extension. An attacker could pos
Red Hat
php: php: Denial of Service via out-of-bounds read in mysqlnd wire protocol parser
vendor_redhat·2026-09-25·CVSS 3.4
CVE-2025-1218 [LOW] CWE-125 php: php: Denial of Service via out-of-bounds read in mysqlnd wire protocol parser
php: php: Denial of Service via out-of-bounds read in mysqlnd wire protocol parser
A flaw was found in PHP. The MySQL Native Driver (mysqlnd) wire protocol parser fails to verify that an incoming packet contains enough bytes before reading its fields. A malicious or compromised database server can send a truncated packet, causing the client application to read past the buffer boundary. This issue can lead to a process crash, resulting in a Denial of Service (DoS), or potentially leak sensitive memory.
Package: php (Red Hat Enterprise Linux 10) - Fix deferred
Package: php8.4 (Red Hat Enterprise Linux 10) - Fix deferred
Package: php (Red Hat Enterprise Linux 6) - Out of support scope
Package: php (Red Hat Enterprise Linux 7) - Fix deferred
Package: php:7.4/php (Red Hat Enterprise Linux
VulDB
PHP up to 8.2.33/8.3.34/8.4.25/8.5.10 mysqlnd wire protocol parser out-of-bounds
vuldb·2026-09-25·CVSS 3.4
CVE-2025-1218 [LOW] PHP up to 8.2.33/8.3.34/8.4.25/8.5.10 mysqlnd wire protocol parser out-of-bounds
A vulnerability was found in PHP up to 8.2.33/8.3.34/8.4.25/8.5.10. It has been declared as critical. The impacted element is an unknown function of the component mysqlnd wire protocol parser. The manipulation results in out-of-bounds read.
This vulnerability is reported as CVE-2025-1218. The attack can be launched remotely. No exploit exists.
It is recommended to upgrade the affected component.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2025-1218 php: php: Denial of Service via out-of-bounds read in mysqlnd wire protocol parser [fedora-all]
bugzilla·2026-10-14·CVSS 3.4
CVE-2025-1218 [LOW] CVE-2025-1218 php: php: Denial of Service via out-of-bounds read in mysqlnd wire protocol parser [fedora-all]
CVE-2025-1218 php: php: Denial of Service via out-of-bounds read in mysqlnd wire protocol parser [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
The mysqlnd wire protocol parser reads fields out of server packets before checking that the packet still holds enough bytes for them. A malicious or compromised MySQL server can send a truncated packet and make the client read past the end of the packet buffer, which is undefined behaviour and can crash the process.
Bugzilla
CVE-2025-1218 php: php: Denial of Service via out-of-bounds read in mysqlnd wire protocol parser
bugzilla·2026-09-25·CVSS 3.4
CVE-2025-1218 [LOW] CVE-2025-1218 php: php: Denial of Service via out-of-bounds read in mysqlnd wire protocol parser
CVE-2025-1218 php: php: Denial of Service via out-of-bounds read in mysqlnd wire protocol parser
The mysqlnd wire protocol parser reads fields out of server packets before checking that the packet still holds enough bytes for them. A malicious or compromised MySQL server can send a truncated packet and make the client read past the end of the packet buffer, which is undefined behaviour and can crash the process.
2026-09-25
Published