CVE-2019-3557

9.8 criticalEPSS 1.7%

Critical (9.8) in facebook hhvm. EPSS 1.7% chance of exploitation in the next 30 days.

The implementations of streams for bz2 and php://output improperly implemented their readImpl functions, returning -1 consistently. This behavior caused some stream functions, such as stream_get_line, to trigger an out-of-bounds read when operating on such malformed streams. The implementations were updated to return valid values consistently. This affects all supported versions of HHVM (3.30 and 3.27.4 and below).

Severity

CVSS 3.0

9.8 critical

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 1.7% chance of exploitation in the next 30 days; higher than 77% of CVEs (scores of 2026-10-31)
CWE: CWE-125
Published: 2019-01-15
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

facebook:hhvm

References

https://github.com/facebook/hhvm/commit/6e4dd9ec3f14b48170fc45dc9d13a3261765f994
https://hhvm.com/blog/2019/01/14/hhvm-3.30.2.html
https://github.com/facebook/hhvm/commit/6e4dd9ec3f14b48170fc45dc9d13a3261765f994
https://hhvm.com/blog/2019/01/14/hhvm-3.30.2.html

Check your stack JSON