TI-2018-04664 Aliases CVE-2018-6340 GHSA-q37v-wf54-qchq

Out-of-bounds read in Meta HHVM

MEDIUM 40CWE-125Published 2018-12-31 · Updated 2025-05-06

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: High
Impact type: —
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA.

Summary

The Memcache::getextendedstats function can be used to trigger an out-of-bounds read. Exploiting this issue requires control over memcached server hostnames and/or ports. This affects all supported versions of HHVM (3.30 and 3.27.4 and below).

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.0143 73rd percentileScored 2026-11-07

Fix Fixed HHVM (Facebook): 3.27.5

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Meta	HHVM	3.30.1; 3.30.0 and later; 3.27.5; before 3.27.5	3.27.5	Patch available	CNA

HHVM VendorMeta Affected 3.30.1; 3.30.0 and later; 3.27.5; before 3.27.5 Fixed in 3.27.5 Patch available CNA

CPE configurations NVD · 2

CPE	Versions	Role	Vendor
cpe:2.3:a:facebook:hhvm::::::::	up to 3.27.4	Vulnerable	Meta
cpe:2.3:a:facebook:hhvm:3.30:::::::*	3.30	Vulnerable	Meta

cpe:2.3:a:facebook:hhvm:*:*:*:*:*:*:*:* Versions up to 3.27.4 Vulnerable ·Meta
cpe:2.3:a:facebook:hhvm:3.30:*:*:*:*:*:*:* Versions 3.30 Vulnerable ·Meta

Remediation

Fix · CNA HHVM (Facebook) Fixed in 3.27.5

Timeline

2026-10-02 Threatist record created from CVE-2018-6340
2026-10-03 Alias added: GHSA-q37v-wf54-qchq

References

Patch 1

https://github.com/facebook/hhvm/commit/4bff3bfbe90d10451e4638c2118d1ad1117bb3e3

Advisory 1

https://hhvm.com/blog/2018/12/18/hhvm-3.30.1.html

TI-2018-04659 Improper input validation in Meta HHVM CVSS 3.1CRITICAL 9.8
TI-2022-17147 Broken or risky cryptographic algorithm in Meta HHVM CVSS 3.1CRITICAL 9.8
TI-2019-08934 Memory corruption in Meta HHVM CVSS 3.1CRITICAL 9.8
TI-2021-06352 Heap-based buffer overflow in Meta folly CVSS 3.1CRITICAL 9.8
TI-2019-08935 An invalid free in mb_detect_order can cause the application to crash or potentially… CVSS 3.1CRITICAL 9.8
TI-2016-05898 Integer overflow in bcmath in Facebook HHVM before 3.15.0 allows attackers to have… CVSS 3.0CRITICAL 9.8

See all 39 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences