Snowflake libsnowflakeclient CVE-2026-121925

Exploitation requires the application to use the native SSO/SAML login flow - specifically the Okta SAML post-back handling identified in the release notes - so password/key-pair deployments that do not use SAML SSO are not affected. The attacker must control or compromise the configured identity provider, OR be positioned to redirect the SAML single sign-on endpoint to an attacker-controlled server, and then return an oversized value (the form-action/post-back URL) in the IdP's HTML response that the driver copies into a fixed-size stack buffer. Limiting factors: dependence on a SAML SSO configuration, the need for a compromised-trusted-IdP or network-redirect position rather than any privilege on the target application, and the fact that reliable code execution is only claimed 'in specific circumstances' (the common outcome is a crash). The complete fix is upgrading to the fixed versions; the vendor states users must manually upgrade.

This is a genuine but conditional, mid-tier priority rather than a drop-everything emergency, and the signals largely agree. The input CVSS is 6.6 (medium): AV:N but AC:H and PR:H, meaning exploitation is network-reachable yet gated behind significant prerequisites. No EPSS score, no CISA KEV listing, and no PoC/exploit reference were provided, so there is no public exploit identified at time of analysis and no evidence of active exploitation - consistent with the vendor's 'this_month' decision label (patch on a normal maintenance cadence, not act_now/emergency). The dominant risk control is the precondition: an attacker must control or compromise the configured identity provider, or be able to redirect the SAML SSO endpoint to an attacker-controlled server. That is a privileged network/trust position, so a victim with a trustworthy IdP and protected SSO endpoint faces limited exposure. One discrepancy to flag: the vendor vector uses PR:H, but the described mechanism needs no privileges on the vulnerable application itself - it needs a compromised/MITM trusted component, which is better modeled as attack complexity (my independent assessment uses PR:N with AC:H / AT:P). Finally, the description qualifies remote code execution as occurring only 'in specific circumstances,' so the realistic default outcome is a crash (DoS), with RCE unverified rather than confirmed.

An attacker who has compromised or is impersonating the configured SAML/Okta identity provider - or who can redirect the SAML SSO endpoint to their own server - returns a malicious HTML response containing an oversized value (the Okta post-back/form-action URL per the release notes). When the Snowflake PHP PDO driver or libsnowflakeclient copies that value into a fixed-size stack buffer during the native SSO login, the buffer overflows, crashing the application or, in specific circumstances, executing code in the application's context. No public exploit identified at time of analysis.