MySQLnd Wire Protocol Parser Issues in PHP by The PHP Group

CVE-2025-1218

What is CVE-2025-1218?

The MySQLnd wire protocol parser in PHP improperly handles server packets by reading fields without verifying the packet length. An attacker could exploit a malicious MySQL server to send a truncated packet. This would lead to the client application reading beyond the valid memory range, which could result in instability or process crashes. Proper validation checks for packet size are essential to prevent such vulnerabilities.

References