CVE-2025-1218

Published Sep 25, 2026

Last updated a day ago

Overview

AI description

Automated description summarized from trusted sources.

It appears there might be a slight typo in the CVE number provided. Based on popular articles, a vulnerability identified as CVE-2025-12183 has been widely discussed. This vulnerability affects `org.lz4:lz4-java` versions 1.8.0 and earlier. CVE-2025-12183 involves out-of-bounds memory operations, which can be triggered by remote attackers providing untrusted compressed input. This flaw can lead to a denial of service and allow attackers to read adjacent memory. The issue specifically impacts programs utilizing the `LZ4_decompress_fast` API, also known as the "fast" decompressor, which lacks boundary checks when processing untrusted inputs.

Description: The mysqlnd wire protocol parser reads fields out of server packets before checking that the packet still holds enough bytes for them. A malicious or compromised MySQL server can send a truncated packet and make the client read past the end of the packet buffer, which is undefined behaviour and can crash the process.
Source: security@php.net
NVD status: Received

Risk scores

CVSS 3.1

Type: Secondary
Base score: 3.4
Impact score: 1.4
Exploitability score: 1.6
Vector string: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N
Severity: LOW

Weaknesses

security@php.net: CWE-122

Hype score is a measure of social media activity compared against trending CVEs from the past 12 months. Max score 100.

Hype score: 16

References