Executive brief
A security vulnerability in the Snowflake client library could allow an attacker to take control of a computer or steal sensitive login credentials. This occurs when the software processes specially crafted files or connection settings, potentially leading to unauthorized access to corporate data or service outages. Organizations using this library in their applications should update to the latest version to protect their systems and user accounts.
Technical details
Snowflake libsnowflakeclient versions prior to 2.9.2 contain multiple vulnerabilities: a stack-based buffer overflow (CWE-121) and an out-of-bounds write (CWE-787) in the file download path, and improper validation of connection parameters (CWE-918). The memory corruption issues can be triggered by uploading files with malicious encryption metadata or initialization vectors to a shared internal stage; when a victim process downloads these files, an attacker can achieve remote code execution or memory corruption. Additionally, the lack of connection parameter validation allows attackers to redirect outbound authentication requests to malicious endpoints, potentially capturing service credentials. These exploits require network access and, in some cases, low-privileged authenticated access to a shared stage. The vulnerabilities are resolved in version 2.9.2.
Affected products
- Snowflake libsnowflakeclient 0.1.1 to < 2.9.2
Timeline
- 2026-07-17: patched: Version 2.9.2 released on GitHub
- 2026-07-24: disclosed: CVE-2026-16870 published