blogsafe.org My Downloads

BlogSafe.org

PHP CVEs

Vulnerabilities in the PHP language itself, and which PHP versions they affect.

← Back to CVE list

CVE-2022-31627

CRITICAL 9.8 CVSS 3.1
Published
July 28, 2022
Last modified
June 17, 2026
NVD status
Modified
Reported by
security@php.net
Weakness
CWE-590, CWE-787
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Description

In PHP versions 8.1.x below 8.1.8, when fileinfo functions, such as finfo_buffer, due to incorrect patch applied to the third party code from libmagic, incorrect function may be used to free allocated memory, which may lead to heap corruption.

Affected products and versions

  • PHP — From 8.1.0 (including) to 8.1.8 (excluding)

References

  • bugs.php.net https://bugs.php.net/bug.php?id=81723 Exploit, Issue Tracking, Patch, Third Party Advisory
  • security.gentoo.org https://security.gentoo.org/glsa/202209-20 Third Party Advisory
  • security.netapp.com https://security.netapp.com/advisory/ntap-20220826-0008/ Third Party Advisory
  • nvd.nist.gov Official NVD record