CVE-2025-1218 — Various packet overreads in mysqlnd_writeprotocol.c
The mysqlnd wire protocol parser reads fields out of server packets before checking that the packet still holds enough bytes for them. A malicious or compromised MySQL server ca…
Published: 2026-09-25 · CVSS: 3.4 · CVSS 3.1
The mysqlnd wire protocol parser reads fields out of server packets before checking that the packet still holds enough bytes for them. A malicious or compromised MySQL server can send a truncated packet and make the client read past the end of the packet buffer, which is undefined behaviour and can crash the process.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7