CVSS 3.1
9.8 criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HCVE-2019-11930
Critical (9.8) in facebook hhvm. EPSS 3.2% chance of exploitation in the next 30 days.
An invalid free in mb_detect_order can cause the application to crash or potentially result in remote code execution. This issue affects HHVM versions prior to 3.30.12, all versions between 4.0.0 and 4.8.5, all versions between 4.9.0 and 4.23.1, as well as 4.24.0, 4.25.0, 4.26.0, 4.27.0, 4.28.0, and 4.28.1.
Severity
- EPSS
- 3.2% chance of exploitation in the next 30 days; higher than 88% of CVEs (scores of 2026-10-31)
- CWE
- CWE-763
- Published
- Modified
- Record from
- the NVD, synced
Affected
- facebook:hhvm
References
- https://github.com/facebook/hhvm/commit/524d2e60cfe910406ec6109e4286d7edd545ab36
- https://hhvm.com/blog/2019/10/28/security-update.html
- https://www.facebook.com/security/advisories/cve-2019-11930
- https://github.com/facebook/hhvm/commit/524d2e60cfe910406ec6109e4286d7edd545ab36
- https://hhvm.com/blog/2019/10/28/security-update.html