$ cve CVE-2019-9023 JSON

CVE-2019-9023

9.8

CRITICAL · CVSS 3.0 · EPSS 9.3% (pctl 95)

In your normal cycle

Critical by CVSS (9.8), but no sign of active exploitation.

Description

An issue was discovered in PHP before 5.6.40, 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before 7.3.1. A number of heap-based buffer over-read instances are present in mbstring regular expression functions when supplied with invalid multibyte data. These occur in ext/mbstring/oniguruma/regcomp.c, ext/mbstring/oniguruma/regexec.c, ext/mbstring/oniguruma/regparse.c, ext/mbstring/oniguruma/enc/unicode.c, and ext/mbstring/oniguruma/src/utf32_be.c when a multibyte regular expression pattern contains invalid multibyte sequences.

Scoring

CVSS	9.8 (CRITICAL, v3.0)
Vector	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS	9.32% — more likely to be exploited than 95% of all CVEs
Weakness	CWE-125
On CISA KEV	no
Public exploit	none known
Published	2019-02-22
Last modified	2026-06-17

Affected (5)

Vendor	Product
canonical	ubuntu linux
debian	debian linux
netapp	storage automation store
opensuse	leap
php	php

References

→ the Explorer · watch your stack · NVD