CVE-2024-11233

HIGH EPSS 73.0%

Published Nov 24, 20241y ago · Modified Jun 17, 20261w ago

8.2 CVSS 3.1

High

Published Nov 24, 2024 1y ago

Last Modified Jun 17, 2026 1w ago

Description

In PHP versions 8.1.* before 8.1.31, 8.2.* before 8.2.26, 8.3.* before 8.3.14, due to an error in convert.quoted-printable-decode filter certain data can lead to buffer overread by one byte, which can in certain circumstances lead to crashes or disclose content of other memory areas.

CVSS Details

Base Score

8.2

Exploitability

3.9

Impact

4.2

Vector string

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H

Attack Vector Network

Attack Complexity Low

Privileges Required None

User Interaction None

Scope Unchanged

Confidentiality Low

Integrity None

Availability High

Threat Intelligence

EPSS Exploit Probability

73.0% percentile

Exploit & Patch Status

Public Exploit Known

No Patch Available

Weaknesses 2

CWE-122

CWE-787 Out-of-bounds Write Memory Safety

Affected Products 3

Vendor	Product	Version	Range
php	php	*	≥8.1.0 – <8.1.31
php	php	*	≥8.2.0 – <8.2.26
php	php	*	≥8.3.0 – <8.3.14

References 3

github.com https://github.com/php/php-src/security/advisories/GHSA-r977-prxv-hc43

ExploitVendor Advisory
lists.debian.org https://lists.debian.org/debian-lts-announce/2024/12/msg00007.html
security.netapp.com https://security.netapp.com/advisory/ntap-20241220-0008/

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.