CVE-2026-16870 describes multiple security vulnerabilities in Snowflake libsnowflakeclient versions prior to 2.9.2. The primary issues include a stack-based buffer overflow and an out-of-bounds write in the file download path, exploitable by uploading files with crafted encryption metadata or initialization vector metadata to shared internal stages. This can lead to remote code execution or memory corruption on victim hosts. Additionally, improper validation of connection parameters can allow attacker-controlled redirection of outbound authentication requests, potentially exposing credentials and tokens. The vulnerabilities require specific conditions such as shared internal stages between principals of different privilege levels or embedding deployments where lower-privileged principals influence connection configuration while higher-privileged credentials are active. Vendor patches are available in libsnowflakeclient 2.9.2, Snowflake PHP PDO Driver 4.1.0, and Snowflake ODBC Driver 3.19.0. Users must manually upgrade to these versions to remediate the issues.

Successful exploitation can result in remote code execution on victim hosts, memory corruption via out-of-bounds writes, and credential or token exfiltration through redirection of authentication requests. The impact is limited to deployments where shared internal stages exist between principals of differing privilege levels or embedding deployments with mixed privilege configurations. Confidentiality, integrity, and availability of affected systems and data can be severely compromised.

A fix is available. Users must manually upgrade Snowflake libsnowflakeclient to version 2.9.2 or later. Additionally, Snowflake PHP PDO Driver and Snowflake ODBC Driver should be upgraded to versions 4.1.0 and 3.19.0 respectively. Since this is a cloud service, vendor-managed remediation may apply, but manual upgrades are required for embedded deployments. Check the vendor advisory for the latest remediation guidance.