Read the docs
TI-2025-18509 Aliases CVE-2025-24792

Snowflake PHP PDO Driver has a Signed-to-Unsigned Conversion Error

Priority LOW 21CWE-195Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
Required
Attack complexity
High
Impact type
—
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

Snowflake PHP PDO Driver is a driver that uses the PHP Data Objects (PDO) extension to connect to the Snowflake database. Snowflake discovered and remediated a vulnerability in the Snowflake PHP PDO Driver where executing unsupported queries like PUT or GET on stages causes a signed-to-unsigned conversion error that crashes the application using the Driver. This vulnerability affects versions 0.2.0 through 3.0.3. Snowflake fixed the issue in version 3.1.0.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00129 2nd percentileScored 2026-11-07
Fix Fixed pdo_snowflake (snowflakedb): 3.1.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Snowflakepdo_snowflake0.2.0 to before 3.1.03.1.0Patch availableCNA
  • pdo_snowflake VendorSnowflake Affected 0.2.0 to before 3.1.0 Fixed in 3.1.0 Patch available CNA

Remediation

  • Fix · CNA pdo_snowflake (snowflakedb) Fixed in 3.1.0

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-24792

References

Other 1

  • TI-2022-20945 Exponential ReDoS in snowflake-connector-python leads to denial of service CVSS 3.1HIGH 7.5
  • TI-2026-02844 snowflakedb snowflake-jdbc JDBC URL SdkProxyRoutePlanner.java SdkProxyRoutePlanner redos CVSS 4.0MEDIUM 4.8
  • TI-2026-13340 Improper TLS Hostname Verification in Snowflake Connector for Python CVSS 4.0CRITICAL 9.2
  • TI-2026-09272 Streamlit Palette hashing.py weak hash CVSS 4.0LOW 2.0
  • TI-2023-17069 Snowflake Python Connector vulnerable to Command Injection CVSS 3.1HIGH 8.8
  • TI-2023-17068 Snowflake NodeJS Driver vulnerable to Command Injection CVSS 3.1HIGH 8.8
See all 55 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences