CVE-2025-1218

Denial of Service via out-of-bounds read in mysqlnd wire protocol parser

Publication Date 2026-09-25
Severity Low
Type Denial of Service
Affected PHP Versions
  • 7.2.0-7.2.34
  • 7.3.0-7.3.33
  • 7.4.0-7.4.33
  • 8.1.0-8.1.34
  • 8.2.0-8.2.33
  • 8.3.0-8.3.34
  • 8.4.0-8.4.25
  • 8.5.0-8.5.10
Fixed Product Versions
  • ZendPHP 7.2
  • ZendPHP 7.3
  • ZendPHP 7.4
  • ZendPHP 8.1
  • ZendPHP 8.2
  • ZendPHP 8.3
  • ZendPHP 8.4
  • ZendPHP 8.5
  • ZendServer 2021.4.8

CVE Details

A bug in mysqlnd_writeprotocol.c allows a MySQL server to send a truncated packet that the PHP client parses without first verifying the packet length. This causes undefined behavior and can crash the PHP process. The consequence is a local denial of service, with no evidence of code execution or data exfiltration.

Recommendations

If you are using the mysqlnd extension and are noticing crashes on pages that access the database, you may need to update to a patched version of PHP.