libsnowflakeclient CVE-2026-16870

For the RCE/OOB-write vectors: the attacker must be an authenticated Snowflake principal able to upload to an internal stage that is SHARED with a higher-privileged victim process (principals of different privilege levels sharing the same internal stage) and must supply a crafted encryption-metadata field - specifically a malicious encryption key/metadata field (buffer overflow) or a crafted initialization vector (IV) metadata field (out-of-bounds write); the victim process must subsequently download that file. For the credential-redirect vector: the deployment must be an embedding scenario where a lower-privileged principal can influence connection configuration parameters (account/region/host/protocol/port) while higher-privileged service credentials are in use. Limiting factors: none of the vectors work against deployments that isolate stages by privilege level or that prevent low-privileged control of connection parameters; all require an authenticated principal (PR:L), and exploitation depends on the victim performing a download or an outbound auth request.

The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8) rates this High/Critical with low complexity, but the description materially qualifies that score: exploitation of the memory-corruption flaws is limited to deployments where principals of differing privilege share the same internal stage, and the credential-redirect flaw is limited to embedding deployments where a low-privileged principal can influence connection configuration while higher-privileged credentials are in use. These are meaningful, non-default preconditions, so real-world AC is arguably higher than the AC:L in the published vector. No EPSS score, KEV entry, POC, or SSVC decision data was provided; absent those signals and given the specialized preconditions, this reads as a genuine multi-vector risk for specific shared-stage/embedding architectures rather than broadly wormable mass-exploitation. The PR:L is appropriate since the attacker must be an authenticated principal with stage-write or config-influence capability.

In a multi-tenant setup where a low-privileged principal and a higher-privileged service both use the same Snowflake internal stage, the attacker uploads a file whose encryption metadata (encryption key/IV field) is crafted to overflow a stack buffer in the victim's download path. When the higher-privileged process later downloads and decrypts that file via libsnowflakeclient <2.9.2, the overflow or out-of-bounds write corrupts memory and can lead to code execution in the victim context. No public exploit is identified at time of analysis, and the network attack vector is gated by the shared-stage and authenticated-principal preconditions.