CVE-2026-16870
Received Received - Intake

Remote Code Execution in Snowflake libsnowflakeclient

Publication date: 2026-07-24

Last updated on: 2026-07-24

Assigner: 412d305a-227d-44f9-a262-a31ba44f2aea

Description
Multiple security vulnerabilities in Snowflake libsnowflakeclient versions prior to 2.9.2 could allow remote code execution and credential exfiltration. A stack-based buffer overflow in the file download path could allow remote code execution on a victim host. An attacker could exploit this by uploading a file with a crafted encryption metadata field to a shared internal stage that a victim process later downloads, and impact would be limited to deployments where principals with different privilege levels share the same internal stage. A related out-of-bounds write in the same download path could allow memory corruption with attacker-controlled write primitives. An attacker may exploit this through a crafted initialization vector metadata field on a shared stage, and impact would be limited by the same stage-write precondition. Improper validation of connection parameters could allow an attacker-controlled input to redirect outbound authentication requests — including credentials and tokens — to an attacker-controlled endpoint. Impact is limited to embedding deployments where a lower-privileged principal can influence connection configuration while higher-privileged service credentials are in use. The fix is available in Snowflake libsnowflakeclient version 2.9.2. Users must manually upgrade.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-24
Last Modified
2026-07-24
Generated
2026-07-24
AI Q&A
2026-07-24
EPSS Evaluated
N/A
NVD
CVE-2026-16870
EUVD
EUVD-2026-48485

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
snowflake libsnowflakeclient 2.9.2
snowflake libsnowflakeclient to 2.9.2 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-121 A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
CWE-787 The product writes data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Multiple security vulnerabilities in Snowflake libsnowflakeclient versions prior to 2.9.2 could allow remote code execution and credential exfiltration. A stack-based buffer overflow in the file download path could allow remote code execution on a victim host. An attacker could exploit this by uploading a file with a crafted encryption metadata field to a shared internal stage that a victim process later downloads. A related out-of-bounds write in the same download path could allow memory corruption with attacker-controlled write primitives. Improper validation of connection parameters could allow an attacker-controlled input to redirect outbound authentication requests including credentials and tokens to an attacker-controlled endpoint.

Detection Guidance

Detecting this vulnerability requires checking the version of the Snowflake libsnowflakeclient library. If your system uses a version prior to 2.9.2, it is vulnerable. Commands to check the version depend on your environment. For example, in a Python environment, you might run pip show snowflake-connector-python or pip show libsnowflakeclient to check the installed version.

Impact Analysis
  • Remote code execution on your system if you download a file with crafted encryption metadata from a shared internal stage.
  • Memory corruption with attacker-controlled write primitives through a crafted initialization vector metadata field.
  • Credential or token theft if connection parameters are manipulated to redirect authentication requests to an attacker-controlled endpoint.
Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, potentially violating GDPR's data protection requirements and HIPAA's security and privacy rules. Exfiltration of credentials or tokens may also result in compliance breaches due to unauthorized data access or disclosure.

Mitigation Strategies

Immediately upgrade to Snowflake libsnowflakeclient version 2.9.2 or later. This can be done by updating the library in your environment using package managers like pip (pip install --upgrade snowflake-connector-python) or by following your organization's software update procedures. Ensure no shared internal stages are used across principals with different privilege levels.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-16870. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart