CVE-2025-1218
PHP: heap buffer overflow can lead to denial of service
- Risk score
- 56/100
- CVSS
- 5.9 v3.1
- Exploit chance (30 days)
- 0.4%
- Published
- 25 Sep 2026
Open in the live forecast Today's forecast
What to know
- What it is
- The mysqlnd wire protocol parser reads fields out of server packets before checking that the packet still holds enough bytes for them. A malicious or compromised MySQL server can send a truncated packet and make the client read past the end of the packet buffer, which is undefined behaviour and can crash the process.
- Affected
- PHP
- Fix
- Apply the vendor's security update; see the linked advisory.
- Exploitation
- Public proof of concept
Story map
At a glance
PHP2Shell: Red, act today. PHP uses longjmp() for out-of-memory (OOM) errors, which can lead to remote code execution (RCE). An attacker could exploit this vulnerability to execute arbitrary code on a targeted system.
The flaws
- CVE-2025-1218: Heap buffer overflow can lead to denial of service (CVSS 5.9 · EPSS 0%)
- CVE-2026-109618: Use-after-free can lead to remote code execution (CVSS 9.8 · EPSS 12%)
- CVE-2026-109619: PHP has various global state that temporarily points into request memory (CVSS 8.1 · EPSS 6%)
- CVE-2026-91765: Denial of service (CVSS 7.5 · EPSS 1%)
The fix
Fix: Check the linked advisory for a fix, as none is provided in the record.
Who is exposed: {'products': ['PHP'], 'packages': [], 'versions': ['all versions']}
Where it stands
- Exploitation reported in the press
- 6 outlets covering it
How it unfolded
- 24 Sep, PHP releases (official): PHP 8.3.35 Released!
- 24 Sep, PHP releases (official): PHP 8.5.11 Released!
- 21 Oct, The Hacker News (press): PHP2Shell: Two Unpatched Critical PHP RCE Flaws (CVSS 9.2) Trigger Emergency Security Alert
- 21 Oct, Infosecurity Magazine (press): Critical PHP Vulnerabilities Leaked Ahead of Scheduled Security Patches
- 21 Oct, CISA advisories (US) (official): Critical Vulnerabilities in PHP Require Immediate Patching
- 21 Oct, Ubuntu security notices (official): USN-8948-2: PHP vulnerabilities
- 21 Oct, PHP releases (official): PHP 8.6.0 RC4 available for testing
- 23 Oct, PHP releases (official): Informational advisory: Session upload progress
- 23 Oct, SecurityWeek (press): Mirai Botnet Operators Join PHP2Shell Attacks as ASLR Bypass Exploits Emerge
- 23 Oct, BleepingComputer (press): PHP shares mitigation for new RCE vulnerability with no patch
- 23 Oct, Dark Reading (press): Exposed to PHP2Shell? Cyber Experts Weigh in With Advice
- 25 Oct, Help Net Security (press): Week in review: PHP vulnerabilities patched, exploited Palo Alto GlobalProtect VPN flaw
Connects to
- Same weakness: Heap buffer overflow (CWE-122). 400 other warnings in 30 days
- Same product: Earlier PHP warnings. 7 in the last 90 days
- Reported alongside: PHP: with the next release. CVE-2026-115560 · in 1 of the same article
Why it is Yellow
- CVSS 5.9 medium
- Public exploit or proof of concept referenced
- On your watchlist: php
References
Original description
The mysqlnd wire protocol parser reads fields out of server packets before checking that the packet still holds enough bytes for them. A malicious or compromised MySQL server can send a truncated packet and make the client read past the end of the packet buffer, which is undefined behaviour and can crash the process.
Last activity 25 Sep 2026. Patch Forecast updates every hour.