Read the docs
TI-2019-08256 Aliases CVE-2019-11040GHSA-9mjv-243x-3w2q

Heap buffer overflow in EXIF extension

Priority MEDIUM 46CWE-125Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · None · High
Fix status
Partial Red Hat: 7 fixed, 4 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat.

Summary

When PHP EXIF extension is parsing EXIF information from an image, e.g. via exif_read_data() function, in PHP versions 7.1.x below 7.1.30, 7.2.x below 7.2.19 and 7.3.x below 7.3.6 it is possible to supply it with data what will cause it to read past the allocated buffer. This may lead to information disclosure or crash.

Why it matters now

EPSS 0.04068 90th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial Red Hat: 4 advisoriesRed Hat: 7 fixed, 4 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
PHP GroupPHP7.1.30; 7.2.19; 7.3.6—No fix listedCNA
  • PHP VendorPHP Group Affected 7.1.30; 7.2.19; 7.3.6 Fixed in — No fix listed CNA

CPE configurations NVD · 6

CPEVersionsRoleVendor
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*7.1.0 to before 7.1.30; 7.2.0 to before 7.2.19; 7.3.0 to before 7.3.6VulnerablePHP
cpe:2.3:a:redhat:software_collections:1.0:*:*:*:*:*:*:*1.0VulnerableRed Hat
cpe:2.3:o:opensuse:leap:15.0:*:*:*:*:*:*:*15.0VulnerableopenSUSE
cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*15.1VulnerableopenSUSE
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*9.0VulnerableDebian
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*10.0VulnerableDebian
  • cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Versions 7.1.0 to before 7.1.30; 7.2.0 to before 7.2.19; 7.3.0 to before 7.3.6 Vulnerable ·PHP
  • cpe:2.3:a:redhat:software_collections:1.0:*:*:*:*:*:*:* Versions 1.0 Vulnerable ·Red Hat
  • cpe:2.3:o:opensuse:leap:15.0:*:*:*:*:*:*:* Versions 15.0 Vulnerable ·openSUSE
  • cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:* Versions 15.1 Vulnerable ·openSUSE
  • cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Debian
  • cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Debian

Remediation

Red Hat 4 advisories

  • RHSA-2020:3662 Released 2020-09-08 · Red Hat rating Moderate
    php:7.3 security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream (v. 8) apcu-panel-5.1.17-1.module+el8.1.0+3189+a1bff096.noarch::php:7.3, libzip-1.5.2-1.module+el8.1.0+3189+a1bff096.aarch64::php:7.3, libzip-1.5.2-1.module+el8.1.0+3189+a1bff096.ppc64le::php:7.3 +47
  • RHSA-2020:1624 Released 2020-04-28 · Red Hat rating Moderate
    php:7.2 security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream (v. 8) apcu-panel-5.1.12-2.module+el8.1.0+3202+af5476b9.noarch::php:7.2, libzip-1.5.1-2.module+el8.1.0+3202+af5476b9.aarch64::php:7.2, libzip-1.5.1-2.module+el8.1.0+3202+af5476b9.ppc64le::php:7.2 +47
  • RHSA-2019:3299 Released 2019-11-01 · Red Hat rating Critical
    rh-php72-php security update
    • Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) rh-php72-php-7.2.24-1.el7, rh-php72-php-bcmath-7.2.24-1.el7, rh-php72-php-cli-7.2.24-1.el7 +26
    • Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.5) rh-php72-php-7.2.24-1.el7, rh-php72-php-bcmath-7.2.24-1.el7, rh-php72-php-cli-7.2.24-1.el7 +26
    • Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6) rh-php72-php-7.2.24-1.el7, rh-php72-php-bcmath-7.2.24-1.el7, rh-php72-php-cli-7.2.24-1.el7 +26
    • Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7) rh-php72-php-7.2.24-1.el7, rh-php72-php-bcmath-7.2.24-1.el7, rh-php72-php-cli-7.2.24-1.el7 +26
    • Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) rh-php72-php-7.2.24-1.el7, rh-php72-php-bcmath-7.2.24-1.el7, rh-php72-php-cli-7.2.24-1.el7 +26
Show 1 more Red Hat advisories
  • RHSA-2019:2519 Released 2019-08-19 · Red Hat rating Moderate
    rh-php71-php security, bug fix, and enhancement update
    • Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) rh-php71-php-7.1.30-1.el7, rh-php71-php-bcmath-7.1.30-1.el7, rh-php71-php-cli-7.1.30-1.el7 +26
    • Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.4) rh-php71-php-7.1.30-1.el7, rh-php71-php-bcmath-7.1.30-1.el7, rh-php71-php-cli-7.1.30-1.el7 +26
    • Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.5) rh-php71-php-7.1.30-1.el7, rh-php71-php-bcmath-7.1.30-1.el7, rh-php71-php-cli-7.1.30-1.el7 +26
    • Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6) rh-php71-php-7.1.30-1.el7, rh-php71-php-bcmath-7.1.30-1.el7, rh-php71-php-cli-7.1.30-1.el7 +26
    • Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) rh-php71-php-7.1.30-1.el7, rh-php71-php-bcmath-7.1.30-1.el7, rh-php71-php-cli-7.1.30-1.el7 +26

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Advisory ·

    PHP — openSUSE-SU-2019:1778

    2 records Highest priority Priority MEDIUM 2 MEDIUM

    Other records, highest priority first

    Show all 2 records → Advisory →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 5AffectedNo fix planned: Out of support scope
Red Hat Enterprise Linux 6AffectedNo fix planned: Out of support scope
Red Hat Enterprise Linux 7AffectedNo fix planned: Will not fix
Red Hat Software CollectionsAffectedNo fix planned: Will not fix
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2020:1624, RHSA-2020:3662
Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)Fixed RHSA-2019:2519, RHSA-2019:3299
Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.4)Fixed RHSA-2019:2519
Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.5)Fixed RHSA-2019:2519, RHSA-2019:3299
Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6)Fixed RHSA-2019:2519, RHSA-2019:3299
Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7)Fixed RHSA-2019:3299
Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)Fixed RHSA-2019:2519, RHSA-2019:3299

Timeline

  1. 2026-10-02 Threatist record created from CVE-2019-11040
  2. 2026-10-03 Alias added: GHSA-9mjv-243x-3w2q

References

Exploit 1

Advisory 7

  • TI-2024-04260 Argument Injection in PHP-CGI KEVCVSS 3.1CRITICAL 9.8
  • TI-2026-78794 PHP remote code execution via stale global state KEVCVSS 4.0CRITICAL 9.2
  • TI-2026-78793 Out-of-memory handling flaw in PHP allows remote code execution KEVCVSS 4.0CRITICAL 9.2
  • TI-2024-01743 Command injection via array-ish $command parameter of proc_open() CVSS 3.1CRITICAL 9.4
  • TI-2022-13555 PDO::quote() may return unquoted string CVSS 3.1CRITICAL 9.1
  • TI-2024-10408 Reference counting in php_request_shutdown causes Use-After-Free CVSS 4.0CRITICAL 9.2
See all 107 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences