CVE-2019-11041CWE-125

heap-buffer-overflow on exif_scan_thumbnail in EXIF extension

Medium · published August 9, 2019

CVSS v3.0
4.8
EPSS
4%
Percentile
91.3
In the wild
Unconfirmed
What it is

When PHP EXIF extension is parsing EXIF information from an image, e.g. via exif_read_data() function, in PHP versions 7.1.x below 7.1.31, 7.2.x below 7.2.21 and 7.3.x below 7.3.8 it is possible to supply it with data what will cause it to read past the allocated buffer. This may lead to information disclosure or crash.

The record
Technical detail
CVSS v3.0
4.8 · MEDIUM
Vector
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L
CVSS v4.0
Not supplied
EPSS
0.04420 · 91.3th percentile
Weakness
CWE-125 · Out-of-bounds Read
Published
2019-08-09T19:26Z
EPSS history
Timeline
  • 09 AUG 19:26Z
    heap-buffer-overflow on exif_scan_thumbnail in EXIF extension
    cvelistv5