CVE-2006-0097: Stack-based buffer overflow in the create_named_pipe function in libmysql.c in PHP 4.3.10 and 4.4.x before...

Security readout for executives and security teams

This is an old Windows-only PHP 4 vulnerability that can let an attacker run code if they can pass an overly long MySQL connection host or socket value. The main business concern is legacy internet-facing or internal Windows PHP applications that still use affected PHP 4 versions. Exposure is most likely on legacy Windows servers running PHP 4.3.10 or PHP 4.4.x before 4.4.3, especially applications where user-controlled input can influence mysql_connect host or socket parameters. Current environments are unlikely affected unless old PHP runtimes remain in production. Prioritize this where Windows PHP 4 still exists. The vulnerability is severe, but business urgency depends on legacy exposure. If no affected PHP 4 Windows runtime is present, residual risk is low. Mitigation focus: Upgrade affected Windows PHP 4 installations to PHP 4.4.3 or later vendor-fixed releases.; Inventory Windows hosts for PHP 4.3.10 and PHP 4.4.x before 4.4.3.; Review applications for user-controlled mysql_connect host or socket arguments..

Prepared

Jun 29, 2026, 15:35 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.