CVE-2025-1218: Various packet overreads in mysqlnd_writeprotocol.c
Published Sep 24, 2026
·Updated
Fixed (Various packet overreads in mysqlnd wire protocol). (CVE-2025-1218)
Other sources
The mysqlnd wire protocol parser reads fields out of server packets before checking that the packet still holds enough bytes for them. A malicious or compromised MySQL server can send a truncated packet and make the client read past the end of the packet buffer, which is undefined behaviour and can crash the process.
— MITRE
Various packet overreads in mysqlndwriteprotocol.c
— Microsoft
Affected Software
2 affected componentsFixes available
PHP PHP<8.4.26
8.4.26
Microsoft azl3 php 8.3.33-1<8.3.35-1
8.3.35-1
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 8.4.26 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 8.3.35-1
Event History
Sep 24, 2026
CVE Published
via PHP·12:00 AM
Data Sourced
via PHP·12:00 AM
DescriptionAffected Software
Sep 25, 2026
CVE Published
via MITRE·08:48 PM
Data Sourced
via MITRE·08:48 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·09:17 PM
DescriptionSeverityWeakness
Sep 28, 2026
Data Sourced
via Microsoft·06:12 AM
DescriptionSeverityWeaknessAffected Software