TI-2019-08931 Aliases CVE-2019-11926 GHSA-rjfc-697q-4r5p

Memory corruption in Meta HHVM

MEDIUM 46CWE-119Published 2019-09-06 · Updated 2024-08-04

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: No fix listed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-119 and the CVSS impact.

Summary

Insufficient boundary checks when processing M_SOFx markers from JPEG headers in the GD extension could allow access to out-of-bounds memory via a maliciously constructed invalid JPEG input. This issue affects HHVM versions prior to 3.30.9, all versions between 4.0.0 and 4.8.3, all versions between 4.9.0 and 4.15.2, and versions 4.16.0 to 4.16.3, 4.17.0 to 4.17.2, 4.18.0 to 4.18.1, 4.19.0, 4.20.0 to 4.20.1.

Why it matters now

EPSS 0.0229 83rd percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Meta	HHVM	4.21.0; 4.20.2; 4.20.0 and later; 4.19.1; 4.19.0 and later; 4.18.2; 4.18.0 and later; 4.17.3; 4.17.0 and later; 4.16.4; 4.16.0 and later; 4.15.3; 4.9.0 and later; 4.8.4; 4.0.0 and later; 3.30.10; up to 3.30.9	—	No fix listed	CNA

HHVM VendorMeta Affected 4.21.0; 4.20.2; 4.20.0 and later; 4.19.1; 4.19.0 and later; 4.18.2; 4.18.0 and later; 4.17.3; 4.17.0 and later; 4.16.4; 4.16.0 and later; 4.15.3; 4.9.0 and later; 4.8.4; 4.0.0 and later; 3.30.10; up to 3.30.9 Fixed in — No fix listed CNA

CPE configurations NVD · 2

CPE	Versions	Role	Vendor
cpe:2.3:a:facebook:hhvm::::::::	up to 3.30.9; 4.0.0 – 4.8.3; 4.9.0 – 4.15.2; 4.16.0 – 4.16.3; 4.17.0 – 4.17.2; 4.18.0 – 4.18.1; 4.20.0 – 4.20.1	Vulnerable	Meta
cpe:2.3:a:facebook:hhvm:4.19.0:::::::*	4.19.0	Vulnerable	Meta

cpe:2.3:a:facebook:hhvm:*:*:*:*:*:*:*:* Versions up to 3.30.9; 4.0.0 – 4.8.3; 4.9.0 – 4.15.2; 4.16.0 – 4.16.3; 4.17.0 – 4.17.2; 4.18.0 – 4.18.1; 4.20.0 – 4.20.1 Vulnerable ·Meta
cpe:2.3:a:facebook:hhvm:4.19.0:*:*:*:*:*:*:* Versions 4.19.0 Vulnerable ·Meta

Remediation

No fixed version listed by the sources yet.

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Release · 2019-09-06
Facebook HHVM unspecified
2 records Highest priority Priority MEDIUM 2 MEDIUM
Other records, highest priority first
- TI-2019-08930 Memory corruption in Meta HHVMPriority MEDIUM 46
Show all 2 records →

Timeline

2026-10-02 Threatist record created from CVE-2019-11926
2026-10-03 Alias added: GHSA-rjfc-697q-4r5p

References

Patch 1

https://github.com/facebook/hhvm/commit/f9680d21beaa9eb39d166e8810e29fbafa51ad15

Advisory 2

TI-2018-04659 Improper input validation in Meta HHVM CVSS 3.1CRITICAL 9.8
TI-2022-17147 Broken or risky cryptographic algorithm in Meta HHVM CVSS 3.1CRITICAL 9.8
TI-2019-08934 Memory corruption in Meta HHVM CVSS 3.1CRITICAL 9.8
TI-2021-06352 Heap-based buffer overflow in Meta folly CVSS 3.1CRITICAL 9.8
TI-2019-08935 An invalid free in mb_detect_order can cause the application to crash or potentially… CVSS 3.1CRITICAL 9.8
TI-2016-05898 Integer overflow in bcmath in Facebook HHVM before 3.15.0 allows attackers to have… CVSS 3.0CRITICAL 9.8

See all 39 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences