Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
3.4
CVE-2025-1218: PHP MySQL driver may crash from crafted server packet
CVE-2025-1218 · published 24 days ago
Summary
The MySQL driver used by PHP 5, 7.0, 7.2, 8.2 and 8.4 on Debian and Ubuntu can read past the end of a data packet if a MySQL server sends an incomplete response. This can cause the PHP process to stop unexpectedly. Apply the latest security updates for PHP or upgrade to a newer PHP version to fix the problem.
What to do
- Update debian php8.4 to version 8.4.26-1~deb13u1.
- Update bellsoft php83 to version 8.3.35-r0.
- Update libphp to version 8.5.11.
- Update php to version 8.5.11.
- Update php-min to version 8.5.11.
- Update debian php8.2 to version 8.2.34-1~deb12u1.
- Update php group php to version 8.2.34 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Debian:12 | debian | php8.2 |
< 8.2.34-1~deb12u1 Fix: upgrade to 8.2.34-1~deb12u1
|
| Debian:13 | debian | php8.4 |
< 8.4.26-1~deb13u1 Fix: upgrade to 8.4.26-1~deb13u1
|
| Debian:14 | debian | php8.4 | All versions |
| Ubuntu:Pro:14.04:LTS | canonical | php5 | All versions |
| Ubuntu:Pro:16.04:LTS | canonical | php7.0 | All versions |
| Ubuntu:Pro:18.04:LTS | canonical | php7.2 | All versions |
| Ubuntu:Pro:20.04:LTS | canonical | php7.4 | All versions |
| Ubuntu:22.04:LTS | canonical | php8.1 | All versions |
| Ubuntu:24.04:LTS | canonical | php8.3 | All versions |
| Ubuntu:26.04:LTS | canonical | php8.5 | All versions |
| – | php group | php | < 8.2.34 |
| Alpaquita:25 | bellsoft | php83 |
>= 8.3.21-r0, < 8.3.35-r0 Fix: upgrade to 8.3.35-r0
|
| Alpaquita:stream | bellsoft | php83 |
>= 8.3.4-r2, < 8.3.35-r0 Fix: upgrade to 8.3.35-r0
|
| Bitnami | – | libphp |
>= 8.5.0, < 8.5.11 Fix: upgrade to 8.5.11
|
| Bitnami | – | php |
>= 8.5.0, < 8.5.11 Fix: upgrade to 8.5.11
|
| Bitnami | – | php-min |
>= 8.5.0, < 8.5.11 Fix: upgrade to 8.5.11
|
Original advisory text
Various packet overreads in mysqlnd_writeprotocol.c
The mysqlnd wire protocol parser reads fields out of server packets before checking that the packet still holds enough bytes for them. A malicious or compromised MySQL server can send a truncated packet and make the client read past the end of the packet buffer, which is undefined behaviour and can crash the process.
References
- https://security-tracker.debian.org/tracker/CVE-2025-1218 Vendor Advisory
- https://ubuntu.com/security/CVE-2025-1218 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2025-1218 Third Party Advisory
- https://github.com/php/php-src/security/advisories/GHSA-r6x9-5r99-36j7 Third Party Advisory
- https://github.com/php/php-src/blob/php-8.4.26/NEWS Third Party Advisory
- https://docs.bell-sw.com/security/cves/CVE-2025-1218 Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2025-1218 URL
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Severity
3.4
Low
Type
CWE-122Heap-based Buffer Overflow
Timeline
Published25 Sep 2026
Updated19 Oct 2026
First seen24 Sep 2026
Sources
DEBIAN-CVE-2025-1218 · OSV
UBUNTU-CVE-2025-1218 · OSV
CVE-2025-1218 · NVD
CVE-2025-1218 · MITRE
BELL-CVE-2025-1218 · OSV
BIT-php-min-2025-1218 · OSV
Track software like this
Free during beta