Summary
generated automatically from NVD dataThe PDO Firebird driver in PHP 8.2, 8.3, 8.4 and 8.5 branches mishandles NUL bytes while building SQL queries token by token. A string token containing a NUL byte is copied with strncat(), which stops at the NUL, so the closing quote is lost and later SQL tokens are read as part of the string. This enables SQL injection when attacker-controlled values pass through PDO::quote() into statements, and the flaw is rated CRITICAL with a CVSS v3.1 score of 9.8.
NVD description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the PDO Firebird driver improperly handles NUL bytes when preparing SQL queries. During token-by-token query construction, a string token containing a NUL byte is copied via strncat(), which stops at the NUL byte, dropping the closing quote and causing subsequent SQL tokens to be interpreted as part of the string. This allows SQL injection when attacker-controlled values are quoted via PDO::quote() and embedded in SQL statements.
EPSS · FIRST.org
0.44%probability of exploitation in the next 30 days
Higher than 36% of scored CVEs
EPSS (Exploit Prediction Scoring System) estimates, from observed exploitation activity, how likely a CVE is to be exploited in the next 30 days. It complements CVSS, which measures severity, not likelihood. Score of 2026-10-16, recomputed daily by FIRST.org.
In-depth analysis on cveo.tech
We've published a detailed analysis of this CVE — exploitation, IOCs and mitigation.
CVSS v3.1 Score
Information
- Published
- 10 mai 2026
- Updated
- 25 juil. 2026
- Status
- Modified
- Source
- security@php.net
Affected products
Weaknesses (CWE)
Similar CVEs
Other vulnerabilities of type CWE-89
Monitor your products
Get automatic alerts for every new CVE affecting your equipment.