Is CVE-2026-121925 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-121925 being exploited in the wild.

How severe is CVE-2026-121925?

Medium severity, with a CVSS score of 6.6, published 4 November 2026.

Which products and versions are affected?

Snowflake Libsnowflakeclient before 2.11.1; Snowflake PHP PDO Driver before 4.3.0.

Is there a fix for CVE-2026-121925?

Yes: fixed in libsnowflakeclient 2.11.1, Snowflake PHP PDO Driver 4.3.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-121925 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-121925?

Check whether you run Snowflake Libsnowflakeclient or Snowflake PHP PDO Driver at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-121925: Snowflake libsnowflakeclient stack buffer overflow in SAML auth

CVE-2026-121925 · Severity: medium · CVSS 6.6 · Published 2026-11-04

Snowflake's database client libraries contain a stack buffer overflow flaw in SAML-based single sign-on authentication. An attacker who controls or compromises the identity provider server could return an oversized response that crashes the application or potentially executes arbitrary code with the application's privileges.

Technologies: Snowflake Libsnowflakeclient, Snowflake PHP PDO Driver. Vendors: Snowflake.

Quick answers

Is CVE-2026-121925 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-121925 being exploited in the wild.
How severe is CVE-2026-121925?: Medium severity, with a CVSS score of 6.6, published 4 November 2026.
Which products and versions are affected?: Snowflake Libsnowflakeclient before 2.11.1; Snowflake PHP PDO Driver before 4.3.0.
Is there a fix for CVE-2026-121925?: Yes: fixed in libsnowflakeclient 2.11.1, Snowflake PHP PDO Driver 4.3.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-121925 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-121925?: Check whether you run Snowflake Libsnowflakeclient or Snowflake PHP PDO Driver at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: libsnowflakeclient 2.11.1, Snowflake PHP PDO Driver 4.3.0

Technical details

A stack-based buffer overflow exists in libsnowflakeclient during SAML authentication when copying the identity provider's HTML response into a fixed-size buffer without length validation. The vulnerability requires network control or compromise of the SAML identity provider endpoint. Successful exploitation could result in memory corruption, application crash, or remote code execution within the application context running the library.

Affected products

Snowflake libsnowflakeclient before 2.11.1
Snowflake PHP PDO Driver before 4.3.0

Timeline

2026-11-04: disclosed
2026-10-01: patched: PHP PDO Driver 4.3.0 and libsnowflakeclient 2.11.1 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.