CVE-2025-1218
EUVD-2025-21100525.09.2026, 21:17
The mysqlnd wire protocol parser reads fields out of server packets before checking that the packet still holds enough bytes for them. A malicious or compromised MySQL server can send a truncated packet and make the client read past the end of the packet buffer, which is undefined behaviour and can crash the process.Enginsight
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
| Vendor | Product | Version | Source |
|---|---|---|---|
| php | php | 8.2.* ≤ 𝑥 < 8.2.34 | CNA |
| php | php | 8.3.* ≤ 𝑥 < 8.3.35 | CNA |
| php | php | 8.4.* ≤ 𝑥 < 8.4.26 | CNA |
| php | php | 8.5.* ≤ 𝑥 < 8.5.11 | CNA |
Debian Releases
Ubuntu Releases
Ubuntu Product | |||||||||
|---|---|---|---|---|---|---|---|---|---|
| php5 |
| ||||||||
| php7.0 |
| ||||||||
| php7.2 |
| ||||||||
| php7.4 |
| ||||||||
| php8.1 |
| ||||||||
| php8.3 |
| ||||||||
| php8.5 |
|
Vulnerability Media Exposure