CVE-2017-12932

Critical

Published: 18/08/2017(UTC)Translated: 14/06/2026(UTC)NVD NIST

Summary

In PHP versions 7.0.x through 7.0.22 and 7.1.x through 7.1.8, there is a vulnerability related to heap use after free when unserializing untrusted data. This issue is related to improper use of the hash API for key deletion in a situation with an invalid array size.

Risk Assessment

Exploitation of this vulnerability can have an unspecified impact on the integrity of PHP, potentially jeopardizing the security of applications using this platform.

Recommendation

It is recommended to update PHP to the latest version to mitigate this vulnerability and to monitor applications for potential exploits.

Original NVD description (English source)

ext/standard/var_unserializer.re in PHP 7.0.x through 7.0.22 and 7.1.x through 7.1.8 is prone to a heap use after free while unserializing untrusted data, related to improper use of the hash API for key deletion in a situation with an invalid array size. Exploitation of this issue can have an unspecified impact on the integrity of PHP.