Stack-based buffer overflow in Snowflake SAML authentication handling
Key facts
- Attack vector
- Network
- Privileges required
- High
- User interaction
- None
- Attack complexity
- High
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-121 and the CVSS impact.
Summary
Snowflake libsnowflakeclient from 2.1.0 before 2.11.1 and Snowflake PHP PDO Driver from 3.2.0 before 4.3.0 contain a stack-based buffer overflow (CWE-121) during SAML-based authentication. The drivers copy a value from the identity provider's HTML response into a fixed-size buffer without checking its length. An attacker who controls or has compromised the configured identity provider, or who can redirect the SAML single sign-on endpoint, can return an oversized response to crash the application or, in specific circumstances, execute code in the application's context.
Written with Claude Haiku 5.5 from the sources below · 2026-11-04
Description from the CNA
A stack-based buffer overflow in libsnowflakeclient and the Snowflake PHP PDO Driver could, under specific conditions, result in memory corruption during SAML-based authentication. During a native SSO/SAML login flow, the affected drivers may have copied a value taken from the identity provider's HTML response into a fixed-size memory buffer without first validating the length of that value. An attacker who controlled or had compromised the configured identity provider — or who was able to redirect the SAML single sign-on endpoint to an attacker-controlled server — might have leveraged this by returning an oversized response, potentially resulting in a crash or, in specific circumstances, remote code execution within the context of the application running the library. The fix is available in libsnowflakeclient version 2.11.1 and Snowflake PHP PDO Driver version 4.3.0. Users must manually upgrade.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
Upgrade Snowflake Libsnowflakeclient to version 2.11.1 and Snowflake PHP PDO Driver to version 4.3.0. Users must upgrade manually.
Written with Claude Haiku 5.5 from the sources below · 2026-11-04
- Fix · CNA Snowflake PHP PDO Driver (Snowflake) Fixed in 4.3.0
- Fix · CNA Snowflake Libsnowflakeclient (Snowflake) Fixed in 2.11.1
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
Snowflake Libsnowflakeclient, Snowflake PHP PDO Driver 2.11.1, 4.3.0
2 records Highest priority Priority LOW 2 LOW
Other records, highest priority first
- TI-2026-85036 Missing origin validation in Snowflake externalbrowser callbackPriority LOW 28
Timeline
- 2026-11-04 Threatist record created from CVE-2026-121925
- 2026-11-04 Alias added: GHSA-cmv8-j38c-qhxx
- 2026-11-04 CISA SSVC decision points changed
- 2026-11-04 Priority changed: MEDIUM → LOW
More Snowflake vulnerabilities
- TI-2022-20945 Exponential ReDoS in snowflake-connector-python leads to denial of service CVSS 3.1HIGH 7.5
- TI-2026-02844 snowflakedb snowflake-jdbc JDBC URL SdkProxyRoutePlanner.java SdkProxyRoutePlanner redos CVSS 4.0MEDIUM 4.8
- TI-2026-13340 Improper TLS Hostname Verification in Snowflake Connector for Python CVSS 4.0CRITICAL 9.2
- TI-2026-09272 Streamlit Palette hashing.py weak hash CVSS 4.0LOW 2.0
- TI-2023-17069 Snowflake Python Connector vulnerable to Command Injection CVSS 3.1HIGH 8.8
- TI-2023-17068 Snowflake NodeJS Driver vulnerable to Command Injection CVSS 3.1HIGH 8.8
Sources
- CVE-2026-121925 · CVE Program
- CVE-2026-121925 · NVD
- FIRST EPSS
- GHSA-cmv8-j38c-qhxx · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences