CVE-2026-121262
Description
A flaw was found in phpMyAdmin's SQL parser. An improper type conversion vulnerability exists in the EXPLAIN statement parser when processing specific token arguments. A remote attacker can exploit this flaw by submitting a specially crafted SQL query, leading to an unhandled exception and causing a Denial of Service (DoS).
Statement
Red Hat Product Security rates this vulnerability as Moderate severity because it is limited to an application denial of service without compromising data confidentiality or system integrity. The flaw is triggered when an application evaluates untrusted SQL queries through the library, leading to an unhandled exception that terminates the parsing worker process. Furthermore, phpMyAdmin and its associated standalone parsing libraries are not included by default in Red Hat Enterprise Linux, limiting exposure in standard environments.
Understanding the Weakness (CWE)
Other
Technical Impact: Varies by Context
When the product accesses the resource using an incompatible type, this could trigger logical errors because the resource does not have expected properties.
Availability,Integrity,Confidentiality
Technical Impact: Read Memory; Modify Memory; Execute Unauthorized Code or Commands; DoS: Crash, Exit, or Restart
If a memory buffer is accessed using an incompatible type, and the allocated buffer is smaller than the type that the code is attempting to access, then an attacker could read or write memory outside the bounds of the buffer, leading to a crash or possibly code execution.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
