CVE-2025-1218
The mysqlnd wire protocol parser reads fields out of server packets before checking that the packet still holds enough bytes for them.
Published Sep 25, 2026 · updated Oct 14, 2026
The mysqlnd wire protocol parser reads fields out of server packets before checking that the packet still holds enough bytes for them. A malicious or compromised MySQL server can send a truncated packet and make the client read past the end of the packet buffer, which is undefined behaviour and can crash the process.
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
Sep 25, 2026 · NIST NVD
Detected
The mysqlnd wire protocol parser reads fields out of server packets before checking that the packet still holds enough bytes for them. A malicious or compromised MySQL server can send a truncated packet and make the client read past the end of the packet buffer, which is undefined behaviour and can crash the process.
Oct 14, 2026 · NIST NVD
Updated
The mysqlnd wire protocol parser reads fields out of server packets before checking that the packet still holds enough bytes for them. A malicious or compromised MySQL server can send a truncated packet and make the client read past the end of the packet buffer, which is undefined behaviour and can crash the process.
Sources
- CVE.orgVulnerability recordCVE-2025-1218
Official CVE identifier
cve.org - FIRST EPSSExploitation probabilityCVE-2025-1218
30-day exploitation probability 0.2%
first.org - NIST NVDVulnerability recordCVE-2025-1218
The mysqlnd wire protocol parser reads fields out of server packets before checking that the packet still holds enough bytes for them. A malicious or compromised MySQL server can send a truncated packet and make the client read past the end of the packet buffer, which is undefine
nvd.nist.gov