CVE-2024-11233

8.2 highEPSS 1.6%

High (8.2) in php php. EPSS 1.6% chance of exploitation in the next 30 days.

In PHP versions 8.1.* before 8.1.31, 8.2.* before 8.2.26, 8.3.* before 8.3.14, due to an error in convert.quoted-printable-decode filter certain data can lead to buffer overread by one byte, which can in certain circumstances lead to crashes or disclose content of other memory areas.

Severity

CVSS 3.1

8.2 high

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H

EPSS: 1.6% chance of exploitation in the next 30 days; higher than 75% of CVEs (scores of 2026-10-31)
CWEs: CWE-787, CWE-122
Published: 2024-11-24
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

php:php

References

https://github.com/php/php-src/security/advisories/GHSA-r977-prxv-hc43
https://lists.debian.org/debian-lts-announce/2024/12/msg00007.html
https://security.netapp.com/advisory/ntap-20241220-0008/

Check your stack JSON