CVE-2025-1218

Received Received - Intake

MySQLnd Wire Protocol Parser Memory Corruption Vulnerability

Publication date: 2026-09-25

Last updated on: 2026-09-25

Assigner: PHP Group

Description

The mysqlnd wire protocol parser reads fields out of server packets before checking that the packet still holds enough bytes for them. A malicious or compromised MySQL server can send a truncated packet and make the client read past the end of the packet buffer, which is undefined behaviour and can crash the process.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-25

Last Modified

2026-09-25

Generated

2026-09-26

AI Q&A

2026-09-26

EPSS Evaluated

N/A

NVD

CVE-2025-1218

Affected Vendors & Products

Vendor	Product	Version / Range
php	mysqlnd	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-122	A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().

Attack-Flow Graph

Executive Summary

This vulnerability involves the mysqlnd wire protocol parser in PHP reading fields from MySQL server packets without first verifying if the packet contains enough data. A malicious or compromised MySQL server could send a truncated packet, causing the client to read past the packet buffer's end. This leads to undefined behavior, which may crash the process.

Detection Guidance

This vulnerability involves the mysqlnd wire protocol parser reading fields from truncated MySQL server packets. Detection requires monitoring for unexpected crashes in MySQL client applications or network traffic anomalies. Check MySQL client logs for segmentation faults or memory access errors. Use tcpdump or Wireshark to inspect MySQL protocol traffic for truncated packets. Ensure mysqlnd and MySQL client libraries are updated to the latest patched versions.

Impact Analysis

If exploited, this vulnerability could cause applications using mysqlnd to crash unexpectedly. While it does not directly allow data theft or modification, crashes could lead to denial-of-service conditions, disrupting services that rely on MySQL connections.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It is a low-severity issue (CVSS 3.4) involving undefined behavior due to improper packet parsing in the MySQL native driver (mysqlnd). No data disclosure or integrity issues are indicated, so typical compliance controls remain unaffected.

Mitigation Strategies

Update the mysqlnd library to the latest version provided by your PHP distribution. Ensure MySQL client connections are only made to trusted servers to prevent malicious packet injection.

Hi! I’m here to help you understand CVE-2025-1218. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70