CVE-2025-1218EPSS p7.1%
CVE-2025-1218CVE-2025-1218
Description
The mysqlnd wire protocol parser reads fields out of server packets before checking that the packet still holds enough bytes for them. A malicious or compromised MySQL server can send a truncated packet and make the client read past the end of the packet buffer, which is undefined behaviour and can crash the process.
Scoring
| CVSS | 3.4 () |
| Vector | CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N |
| EPSS | 0.18% probability of exploitation · percentile 7.1% · 2026-10-05T12:00:23Z |
| Last modified | 2026-09-29 |