Buffer underflow in bc_shift_addsub
Priority LOW 31CWE-125Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- Low · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-125 and the CVSS impact.
Summary
In PHP versions 7.2.x below 7.2.26, 7.3.x below 7.3.13 and 7.4.0, PHP bcmath extension functions on some systems, including Windows, can be tricked into reading beyond the allocated space by supplying it with string containing characters that are identified as numeric by the OS but aren't ASCII numbers. This can read to disclosure of the content of some memory locations.
Why it matters now
EPSS 0.04116 90th percentileScored 2026-11-07
Fix Fixed PHP (PHP Group): 7.2.26, 7.3.13, 7.4.1
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| PHP Group | PHP | 7.2.x to before 7.2.26; 7.3.x to before 7.3.13; 7.4.x to before 7.4.1 | 7.2.26, 7.3.13, 7.4.1 | Patch available | CNA |
- PHP VendorPHP Group Affected 7.2.x to before 7.2.26; 7.3.x to before 7.3.13; 7.4.x to before 7.4.1 Fixed in 7.2.26, 7.3.13, 7.4.1 Patch available CNA
CPE configurations NVD · 15
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:php:php:*:*:*:*:*:*:*:* | 7.2.0 – 7.2.26; 7.3.0 – 7.3.13 | Vulnerable | PHP |
| cpe:2.3:a:php:php:7.4.0:*:*:*:*:*:*:* | 7.4.0 | Vulnerable | PHP |
| cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* | 8.0 | Vulnerable | Debian |
| cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* | 9.0 | Vulnerable | Debian |
| cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* | 10.0 | Vulnerable | Debian |
| cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:* | 30 | Vulnerable | Fedoraproject |
| cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:* | 31 | Vulnerable | Fedoraproject |
| cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:* | 15.1 | Vulnerable | openSUSE |
| cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:-:*:*:* | 12.04 | Vulnerable | Canonical |
| cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:* | 14.04 | Vulnerable | Canonical |
- cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Versions 7.2.0 – 7.2.26; 7.3.0 – 7.3.13 Vulnerable ·PHP
- cpe:2.3:a:php:php:7.4.0:*:*:*:*:*:*:* Versions 7.4.0 Vulnerable ·PHP
- cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·Debian
- cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Debian
- cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Debian
- cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:* Versions 30 Vulnerable ·Fedoraproject
- cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:* Versions 31 Vulnerable ·Fedoraproject
- cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:* Versions 15.1 Vulnerable ·openSUSE
- cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:-:*:*:* Versions 12.04 Vulnerable ·Canonical
- cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:* Versions 14.04 Vulnerable ·Canonical
Show 5 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:* | 16.04 | Vulnerable | Canonical |
| cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:* | 18.04 | Vulnerable | Canonical |
| cpe:2.3:o:canonical:ubuntu_linux:19.04:*:*:*:*:*:*:* | 19.04 | Vulnerable | Canonical |
| cpe:2.3:o:canonical:ubuntu_linux:19.10:*:*:*:*:*:*:* | 19.10 | Vulnerable | Canonical |
| cpe:2.3:a:tenable:security_center:*:*:*:*:*:*:*:* | before 5.19.0 | Vulnerable | Tenable |
- cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:* Versions 16.04 Vulnerable ·Canonical
- cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:* Versions 18.04 Vulnerable ·Canonical
- cpe:2.3:o:canonical:ubuntu_linux:19.04:*:*:*:*:*:*:* Versions 19.04 Vulnerable ·Canonical
- cpe:2.3:o:canonical:ubuntu_linux:19.10:*:*:*:*:*:*:* Versions 19.10 Vulnerable ·Canonical
- cpe:2.3:a:tenable:security_center:*:*:*:*:*:*:*:* Versions before 5.19.0 Vulnerable ·Tenable
Remediation
- Fix · CNA PHP (PHP Group) Fixed in 7.2.26, 7.3.13, 7.4.1
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Advisory ·
PHP — FEDORA-2019-437d94e271
6 records Highest priority Priority MEDIUM 2 MEDIUM, 4 LOW
Other records, highest priority first
- TI-2019-08265 mail() may release string with refcount==1 twicePriority MEDIUM 49
- TI-2019-08260 link() silently truncates after a null byte on WindowsPriority MEDIUM 41
- TI-2019-08266 Use-after-free in exif parsing under memory sanitizerPriority LOW 39
- Advisory ·
PHP — FEDORA-2019-a54a622670
6 records Highest priority Priority MEDIUM 2 MEDIUM, 4 LOW
Other records, highest priority first
- TI-2019-08265 mail() may release string with refcount==1 twicePriority MEDIUM 49
- TI-2019-08260 link() silently truncates after a null byte on WindowsPriority MEDIUM 41
- TI-2019-08266 Use-after-free in exif parsing under memory sanitizerPriority LOW 39
Show 2 more groups
- Advisory ·
PHP — openSUSE-SU-2020:0080
4 records Highest priority Priority LOW 4 LOW
Other records, highest priority first
- TI-2019-08266 Use-after-free in exif parsing under memory sanitizerPriority LOW 39
- TI-2019-08263 Heap-buffer-overflow READ in exifPriority LOW 39
- TI-2019-08261 DirectoryIterator class silently truncates after a null bytePriority LOW 38
- Advisory ·
PHP — USN-4239-1
4 records Highest priority Priority LOW 4 LOW
Other records, highest priority first
- TI-2019-08266 Use-after-free in exif parsing under memory sanitizerPriority LOW 39
- TI-2019-08263 Heap-buffer-overflow READ in exifPriority LOW 39
- TI-2019-08261 DirectoryIterator class silently truncates after a null bytePriority LOW 38
Vendor assessments
Red Hat
Red Hat rating: Low. Red Hat's page for this CVE →
Not affected: 5 products
- Red Hat Enterprise Linux 5
- Red Hat Enterprise Linux 6
- Red Hat Enterprise Linux 7
- Red Hat Enterprise Linux 8
- Red Hat Software Collections
Timeline
- 2026-10-02 Threatist record created from CVE-2019-11046
- 2026-10-03 Alias added: GHSA-6c5q-qpjx-9564
References
Advisory 12
- [debian-lts-announce] 20191229 [SECURITY] [DLA 2050-1] php5 security update
- https://security.netapp.com/advisory/ntap-20200103-0002/
- FEDORA-2019-437d94e271
- FEDORA-2019-a54a622670
- USN-4239-1
- openSUSE-SU-2020:0080
- 20200218 [SECURITY] [DSA 4626-1] php7.3 security update
- DSA-4626
- DSA-4628
- 20200219 [SECURITY] [DSA 4628-1] php7.0 security update
- 20210116 Re: [SECURITY] [DSA 4628-1] php7.0 security update
- https://www.tenable.com/security/tns-2021-14
More PHP Group vulnerabilities
- TI-2024-04260 Argument Injection in PHP-CGI KEVCVSS 3.1CRITICAL 9.8
- TI-2026-78794 PHP remote code execution via stale global state KEVCVSS 4.0CRITICAL 9.2
- TI-2026-78793 Out-of-memory handling flaw in PHP allows remote code execution KEVCVSS 4.0CRITICAL 9.2
- TI-2024-01743 Command injection via array-ish $command parameter of proc_open() CVSS 3.1CRITICAL 9.4
- TI-2022-13555 PDO::quote() may return unquoted string CVSS 3.1CRITICAL 9.1
- TI-2024-10408 Reference counting in php_request_shutdown causes Use-After-Free CVSS 4.0CRITICAL 9.2
Sources
- CVE-2019-11046 · CVE Program
- CVE-2019-11046 · NVD
- FIRST EPSS
- GHSA-6c5q-qpjx-9564 · GitHub Advisory Database · CC BY 4.0
- CVE-2019-11046 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences