CVE-2022-31627CWE-590

Heap buffer overflow in finfo_buffer

High · published July 28, 2022

CVSS v3.1
7.7
EPSS
2%
Percentile
81.9
In the wild
Unconfirmed
What it is

In PHP versions 8.1.x below 8.1.8, when fileinfo functions, such as finfo_buffer, due to incorrect patch applied to the third party code from libmagic, incorrect function may be used to free allocated memory, which may lead to heap corruption.

The record
Technical detail
CVSS v3.1
7.7 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L
CVSS v4.0
Not supplied
EPSS
0.02141 · 81.9th percentile
Weakness
CWE-590 · Free of Memory not on the Heap
Published
2022-07-28T05:50Z
EPSS history
Timeline
  • 28 JUL 05:50Z
    Heap buffer overflow in finfo_buffer
    cvelistv5