CVE-2012-2376 EXPLOIT
10.0
HIGH · CVSS 2.0 · EPSS 19.8% (pctl 97)
Patch early
A public exploit exists.
Description
Buffer overflow in the com_print_typeinfo function in PHP 5.4.3 and earlier on Windows allows remote attackers to execute arbitrary code via crafted arguments that trigger incorrect handling of COM object VARIANT types, as exploited in the wild in May 2012.
Scoring
| CVSS | 10.0 (HIGH, v2.0) |
|---|---|
| Vector | AV:N/AC:L/Au:N/C:C/I:C/A:C |
| EPSS | 19.84% — more likely to be exploited than 97% of all CVEs |
| Weakness | CWE-119 |
| On CISA KEV | no |
| Public exploit | yes |
| Published | 2012-05-21 |
| Last modified | 2026-06-16 |
Affected (2)
| Vendor | Product |
|---|---|
| microsoft | windows |
| php | php |
Public exploits
| Source | Title | Date |
|---|---|---|
| exploit-db | PHP 5.4.3 (Windows x86 Polish) - Code Execution | 2012-05-11 |
References
- http://isc.sans.edu/diary.html?storyid=13255
- http://openwall.com/lists/oss-security/2012/05/20/2
- http://www.exploit-db.com/exploits/18861/
- http://www.securitytracker.com/id?1027089
- https://bugzilla.redhat.com/show_bug.cgi?id=823464
- https://exchange.xforce.ibmcloud.com/vulnerabilities/75778
- http://isc.sans.edu/diary.html?storyid=13255
- http://openwall.com/lists/oss-security/2012/05/20/2
- http://www.exploit-db.com/exploits/18861/
- http://www.securitytracker.com/id?1027089
- https://bugzilla.redhat.com/show_bug.cgi?id=823464
- https://exchange.xforce.ibmcloud.com/vulnerabilities/75778
→ the Explorer · watch your stack · NVD