Vulnerability in PHP Group PHP

[ Description ]Official description

The mysqlnd wire protocol parser reads fields out of server packets before checking that the packet still holds enough bytes for them. A malicious or compromised MySQL server can send a truncated packet and make the client read past the end of the packet buffer, which is undefined behaviour and can crash the process.

[ Fixes ]Fixes and patches

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ Advisories ]Government CERT advisories

• BSI CERT-Bund24 Sep 2026WID-SEC-2026-3585

  PHP: Multiple vulnerabilities Translated from German

  Risk mediumCVE-2026-92842CVE-2026-91765CVE-2026-93682+7 more CVEs
• CERT-FR24 Sep 2026CERTFR-2026-AVI-1227

  Multiple vulnerabilities in PHP Translated from French

  Multiple vulnerabilities have been discovered in PHP. Some of them allow an attacker to cause remote denial of service, a breach of data confidentiality and a breach of data integrity.

  CVE-2025-14181CVE-2026-91765CVE-2026-92842+8 more CVEs

[ References ]References

• github.com/php/php-src/security/advisories/GHSA-r6x9-5r99-36j7