Multiple Security Vulnerabilities in Snowflake libsnowflakeclient (CVE-2026-16870)

What is affected, what to do

Multiple security vulnerabilities in Snowflake libsnowflakeclient versions prior to 2.9.2 could allow remote code execution and credential exfiltration. A stack-based buffer overflow in the file download path could allow remote code execution on a victim host.

Update Snowflake libsnowflakeclient to version 2.9.2, Snowflake PHP PDO Driver to version 4.1.0, Snowflake ODBC Driver to version 3.19.0.

Affected

• Snowflake libsnowflakeclient lt *..2.9.2
• Snowflake PHP PDO Driver lt *..4.1.0
• Snowflake ODBC Driver lt 2.16.3..3.19.0

Fixed in

• Snowflake libsnowflakeclient 2.9.2
• Snowflake PHP PDO Driver 4.1.0
• Snowflake ODBC Driver 3.19.0

Not sure whether and how you are affected? Ask a question about this vulnerability

Metrics

Detection rules

No NEOSEC detection rule is available for this vulnerability yet.

Classification under NIS2 and CRA

Rule-based classification from exploitation status and severity. It does not replace a case-by-case assessment.

NIS2

NIS2 is EU Directive (EU) 2022/2555 to raise the level of cybersecurity across the Union. It substantially broadens obligations compared with the first NIS directive: more sectors, mandatory risk management, staged reporting duties and personal accountability of senior management.

Read in glossary

High technical severity: assess and remediate the vulnerability in vulnerability handling under Art. 21(2)(e) NIS2 and document the decision.

CRA

The CRA is EU Regulation (EU) 2024/2847 setting horizontal cybersecurity requirements for „products with digital elements“ — from industrial controllers and software to connected consumer devices. For the first time manufacturers must ensure security across the entire product lifecycle, handle vulnerabilities and provide security updates.

Read in glossary

From 11.12.2027, Annex I Part II CRA requires manufacturers of affected products with digital elements to handle vulnerabilities without delay and provide security updates.

ISO/IEC 27001

ISO/IEC 27001 is the internationally leading standard for an information security management system (ISMS). It describes a risk-based, process-oriented framework to systematically plan, implement, review and improve information security.

Read in glossary

Control A.8.8, management of technical vulnerabilities: assess relevance to your systems, plan remediation and keep evidence.

Description

Multiple security vulnerabilities in Snowflake libsnowflakeclient versions prior to 2.9.2 could allow remote code execution and credential exfiltration. A stack-based buffer overflow in the file download path could allow remote code execution on a victim host. An attacker could exploit this by uploading a file with a crafted encryption metadata field to a shared internal stage that a victim process later downloads, and impact would be limited to deployments where principals with different privilege levels share the same internal stage. A related out-of-bounds write in the same download path could allow memory corruption with attacker-controlled write primitives. An attacker may exploit this through a crafted initialization vector metadata field on a shared stage, and impact would be limited by the same stage-write precondition. Improper validation of connection parameters could allow an attacker-controlled input to redirect outbound authentication requests — including credentials and tokens — to an attacker-controlled endpoint. Impact is limited to embedding deployments where a lower-privileged principal can influence connection configuration while higher-privileged service credentials are in use. The fix is available in Snowflake libsnowflakeclient version 2.9.2. The Snowflake PHP PDO Driver and Snowflake ODBC Driver embed the affected library; fixes are available in versions 4.1.0 and 3.19.0 respectively. Users must manually upgrade.

Source: NVD (NIST), cvelistv5

Vendors and products

• Snowflake Snowflake Odbc Driver
• Snowflake Snowflake PHP Pdo Driver

Weakness classes (CWE)

• CWE-121Stack-based Buffer Overflow

  Variant

  A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).

  Entry at MITRE CWE-121

• CWE-787Out-of-bounds Write

  Base

  The product writes data past the end, or before the beginning, of the intended buffer.

  Entry at MITRE CWE-787

• CWE-918Server-Side Request Forgery (SSRF)

  Base

  The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

  Entry at MITRE CWE-918

References & sources

• github.comSnowflake Libsnowflakeclient Release Notes

Changes to this CVE

Who changed this CVE and when: NVD (analysis, affected products, CVSS), the CVE publisher (CNA) and additional providers such as CISA (ADP).

1. 24.07.2026Record modifiedCISA ADP

   CISA assessment (SSVC): exploitation: none known, automatable: no

   Show the original change

   Individual changes of this event as published by NVD

   Type	Action	Before	After
   SSVC assessment	added	—	{"id":"CVE-2026-16870","role":"CISA Coordinator","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"version":"2.0.3","timestamp":"2026-07-24T12:27:51.298058Z"}

   Source identifier: 134c704f-9b21-4f2e-91b3-4a467353bcc0

2. 24.07.2026Received412d305a…

   CVSS V3.1: AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

   Weakness type: CWE-787, CWE-918, CWE-121

   Description added or changed

   New references:

   • https://github.com/snowflakedb/libsnowflakeclient/releases/tag/v2.9.2
   Show 7 original changes

   Individual changes of this event as published by NVD

   Type	Action	Before	After
   Affected versions (publisher)	added	—	Snowflake libsnowflakeclient
   Description	added	—	Multiple security vulnerabilities in Snowflake libsnowflakeclient versions prior to 2.9.2 could allow remote code execution and credential exfiltration. A stack-based buffer overflow in the file download path could allow remote code execution on a victim host. An attacker could exploit this by uploading a file with a crafted encryption metadata field to a shared internal stage that a victim process later downloads, and impact would be limited to deployments where principals with different privilege levels share the same internal stage. A related out-of-bounds write in the same download path could allow memory corruption with attacker-controlled write primitives. An attacker may exploit this through a crafted initialization vector metadata field on a shared stage, and impact would be limited by the same stage-write precondition. Improper validation of connection parameters could allow an attacker-controlled input to redirect outbound authentication requests — including credentials and tokens — to an attacker-controlled endpoint. Impact is limited to embedding deployments where a lower-privileged principal can influence connection configuration while higher-privileged service credentials are in use. The fix is available in Snowflake libsnowflakeclient version 2.9.2. Users must manually upgrade.
   CVSS	added	—	AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
   Weakness type (CWE)	added	—	CWE-787
   Weakness type (CWE)	added	—	CWE-918
   Weakness type (CWE)	added	—	CWE-121
   Reference	added	—	https://github.com/snowflakedb/libsnowflakeclient/releases/tag/v2.9.2

   Source identifier: 412d305a-227d-44f9-a262-a31ba44f2aea