CVSS 3.1
7.5 highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NCVE-2020-7067
High (7.5). EPSS 4.3% chance of exploitation in the next 30 days.
In PHP versions 7.2.x below 7.2.30, 7.3.x below 7.3.17 and 7.4.x below 7.4.5, if PHP is compiled with EBCDIC support (uncommon), urldecode() function can be made to access locations past the allocated memory, due to erroneously using signed numbers as array indexes.
Severity
- EPSS
- 4.3% chance of exploitation in the next 30 days; higher than 91% of CVEs (scores of 2026-10-31)
- CWEs
- CWE-125, CWE-196
- Published
- Modified
- Record from
- the NVD, synced
Affected
- debian:debian_linux
- oracle:communications_diameter_signaling_router
- php:php
- tenable:tenable.sc