The vulnerability in PHP's mysqlnd wire protocol parser arises from improper bounds checking when reading fields from server packets. Specifically, the parser does not confirm that the packet contains sufficient bytes before reading, allowing a truncated packet from a malicious or compromised MySQL server to trigger a heap-based buffer overflow. This can cause undefined behavior such as process crashes. The CVSS 3.1 score is 3.4 (low severity), reflecting the complexity of attack and limited impact on confidentiality and integrity.

An attacker controlling or compromising a MySQL server can send malformed truncated packets to a PHP client using mysqlnd, causing the client process to read beyond the packet buffer. This leads to undefined behavior, typically resulting in a crash of the PHP process. There is no indication of confidentiality or integrity compromise, and no known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid connecting PHP mysqlnd clients to untrusted MySQL servers. Monitor vendor communications for updates and apply patches promptly once released.