Stack-Based Buffer Overflow in Snowflake PHP PDO Driver and libsnowflakeclient

CVE-2026-121925

What is CVE-2026-121925?

A stack-based buffer overflow has been identified in the libsnowflakeclient and Snowflake PHP PDO Driver. This vulnerability arises during SAML-based authentication when the affected drivers fail to validate the length of values obtained from the identity provider's HTML response before copying them into a predefined memory buffer. If an attacker controls or compromises the identity provider or redirects the SAML SSO endpoint to their server, they may exploit this flaw by sending an oversized response. This could lead to a potential crash of the application or, under certain conditions, allow for remote code execution within the application's environment. Users are advised to upgrade to libsnowflakeclient version 2.11.1 and Snowflake PHP PDO Driver version 4.3.0 to mitigate this vulnerability.

References