CVE-2025-1218: MySQL Native Driver Buffer Overflow Flaw

CVE-2025-1218 Overview

CVE-2025-1218 is an out-of-bounds read vulnerability in the PHP mysqlnd wire protocol parser. The parser reads fields from server packets before verifying that the packet buffer still contains enough bytes to satisfy those reads. A malicious or compromised MySQL server can send a truncated packet to force the client to read past the end of the packet buffer. This behavior is undefined and can crash the PHP process consuming the MySQL connection. The flaw is tracked under CWE-122 and detailed in the PHP Security Advisory GHSA-r6x9-5r99-36j7.

Critical Impact
A compromised or hostile MySQL server can crash PHP processes by sending truncated protocol packets, causing denial of service to applications that connect to it.

Affected Products

PHP distributions shipping the mysqlnd extension
Applications using PHP's native MySQL driver (mysqli, PDO_MySQL on mysqlnd)
Versions prior to the fixes announced in the PHP security advisory

Discovery Timeline

2026-09-25 - CVE-2025-1218 published to the National Vulnerability Database
2026-09-29 - Last updated in the NVD database

Technical Details for CVE-2025-1218

Vulnerability Analysis

The mysqlnd extension implements the MySQL client/server wire protocol natively in PHP. When parsing server-sent packets, the parser extracts individual fields such as length-encoded integers, strings, and binary blobs. The code reads these fields before confirming the packet buffer contains the required number of bytes. When a MySQL server returns a truncated or malformed packet, the parser dereferences memory beyond the allocated buffer. The result is undefined behavior that typically manifests as a process crash. The attack surface requires a PHP client to connect to an attacker-controlled or compromised MySQL instance over an adjacent network path.

Root Cause

The root cause is a missing bounds check in the packet-reading routines of mysqlnd [CWE-122: Heap-based Buffer Overflow]. Field extraction functions advance the read pointer and consume declared field widths without re-validating remaining buffer length between reads. The parser trusts the length prefix encoded by the server rather than cross-checking it against the physical packet length received on the socket.

Attack Vector

Exploitation requires the victim PHP application to initiate a MySQL connection to a server the attacker controls or has compromised. The attacker crafts a protocol response that declares field widths exceeding the actual packet payload. When mysqlnd processes the response, it reads past the buffer end and the PHP worker crashes. Impact is limited to availability. The advisory does not describe memory disclosure or code execution outcomes. Attack complexity is high because the attacker must position a malicious MySQL endpoint and induce a client connection to it. See the PHP Security Advisory GHSA-r6x9-5r99-36j7 for protocol-level details.

Detection Methods for CVE-2025-1218

Indicators of Compromise

Unexpected PHP-FPM, Apache mod_php, or CLI worker crashes correlated with outbound MySQL sessions
Segmentation faults in process logs referencing mysqlnd frames or php_mysqlnd_read_packet call paths
MySQL connections from PHP hosts to unexpected or newly observed database endpoints

Detection Strategies

Monitor process termination events on PHP hosts for SIGSEGV or SIGBUS signals associated with the PHP interpreter
Correlate crash timestamps with MySQL connection telemetry to identify suspicious server endpoints
Inspect network flows for MySQL protocol conversations crossing trust boundaries or reaching external destinations

Monitoring Recommendations

Enable PHP crash logging and core dump collection on application servers to capture evidence of exploitation attempts
Alert on new or unusual destination IPs on TCP/3306 originating from web application tiers
Track database endpoint allowlists and generate alerts when PHP processes connect outside the approved set

How to Mitigate CVE-2025-1218

Immediate Actions Required

Upgrade PHP to the fixed releases referenced in the PHP Security Advisory GHSA-r6x9-5r99-36j7
Restrict outbound MySQL connectivity from PHP hosts to known, trusted database servers only
Audit application configuration to remove dynamic or user-controlled MySQL connection targets

Patch Information

The PHP project has published fixed versions through the upstream advisory GHSA-r6x9-5r99-36j7. Apply the vendor-supplied PHP packages for your Linux distribution or rebuild PHP from a patched source tarball. Restart PHP-FPM, web server workers, and long-running CLI daemons after upgrading so the new mysqlnd binary is loaded into memory.

Workarounds

Enforce TLS with certificate validation on MySQL connections to prevent attacker-in-the-middle server impersonation
Use egress firewall rules to limit PHP application servers to approved MySQL endpoints on TCP/3306
Operate PHP workers under process supervisors that log and rate-limit repeated crashes to contain denial-of-service impact

bash

# Example egress restriction limiting PHP hosts to an approved MySQL server
iptables -A OUTPUT -p tcp --dport 3306 -d 10.0.10.25 -j ACCEPT
iptables -A OUTPUT -p tcp --dport 3306 -j DROP