CVE-2024-8929 is a heap buffer over-read vulnerability in the mysqlnd extension of PHP. It affects PHP versions 7.4 prior to 7.4.33, 8.1 prior to 8.1.31, 8.2 prior to 8.2.24, and 8.3 prior to 8.3.14. A malicious MySQL server can exploit this vulnerability to cause the PHP client to disclose partial contents of its heap memory, which may include data from other SQL queries or data belonging to other users sharing the same server. This issue is due to improper bounds checking leading to heap buffer over-read. The vulnerability is tracked under multiple CWEs including CWE-125 (out-of-bounds read) and CWE-787 (out-of-bounds write). Vendor advisories from Red Hat confirm the availability of patches and provide updated package versions to remediate the issue.

Exploitation of this vulnerability allows a hostile MySQL server to cause the PHP client to leak partial heap memory contents. This can lead to unauthorized disclosure of sensitive data from other SQL requests or other users on the same server. There is no indication of remote code execution or privilege escalation. No known exploits in the wild have been reported at this time.

Official patches are available and should be applied to affected PHP versions. Red Hat and other vendors have released updated PHP packages that fix this vulnerability. Users should upgrade to PHP versions 7.4.33 or later, 8.1.31 or later, 8.2.24 or later, or 8.3.14 or later as applicable. No additional mitigations are indicated by the vendor advisories.