CVE-2019-11050
MediumCVSS 4.8Exploitation Probability (EPSS)
Very high risk94th percentile - higher than 94% of all known CVEs
Summary
In PHP, the EXIF extension parsing EXIF information from an image (e.g., via exif_read_data()) in versions 7.2.x below 7.2.26, 7.3.x below 7.3.13, and 7.4.0 can read past the allocated buffer, potentially leading to information disclosure or crash.
Risk Assessment
An attacker can exploit this to disclose sensitive memory data or cause a crash of the PHP application.
Recommendation
Upgrade PHP to version 7.2.26, 7.3.13, or later (or 7.4.1+).
Original NVD description (English source)
When PHP EXIF extension is parsing EXIF information from an image, e.g. via exif_read_data() function, in PHP versions 7.2.x below 7.2.26, 7.3.x below 7.3.13 and 7.4.0 it is possible to supply it with data what will cause it to read past the allocated buffer. This may lead to information disclosure or crash.