CVE-2016-1000005

9.8 criticalEPSS 1.4%

Critical (9.8) in facebook hhvm. EPSS 1.4% chance of exploitation in the next 30 days.

mcrypt_get_block_size did not enforce that the provided "module" parameter was a string, leading to type confusion if other types of data were passed in. This issue affects HHVM versions prior to 3.9.5, all versions between 3.10.0 and 3.12.3 (inclusive), and all versions between 3.13.0 and 3.14.1 (inclusive).

Severity

CVSS 3.1

9.8 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 1.4% chance of exploitation in the next 30 days; higher than 72% of CVEs (scores of 2026-10-31)
CWE: CWE-843
Published: 2020-02-19
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

facebook:hhvm

References

https://github.com/facebook/hhvm/commit/39e7e177473350b3a5c34e8824af3b98e25efa89
https://www.facebook.com/security/advisories/cve-2016-1000005
https://github.com/facebook/hhvm/commit/39e7e177473350b3a5c34e8824af3b98e25efa89
https://www.facebook.com/security/advisories/cve-2016-1000005

Check your stack JSON