CVE-2006-0097: PHP

High severity, CVSS 7.5. EPSS: 12.2% chance of exploitation in the next 30 days.

Stack-based buffer overflow in the create_named_pipe function in libmysql.c in PHP 4.3.10 and 4.4.x before 4.4.3 for Windows allows attackers to execute arbitrary code via a long (1) arg_host or (2) arg_unix_socket argument, as demonstrated by a long named pipe variable in the host argument to the mysql_connect function.

Affected products

• PHP PHP: version 4.3.10 only; version 4.4.0 only; version 4.4.1 only; version 4.4.2 only

Published 2006-01-06. Last modified 2026-06-16.