blogsafe.org My Downloads

BlogSafe.org

PHP CVEs

Vulnerabilities in the PHP language itself, and which PHP versions they affect.

← Back to CVE list

CVE-2022-31630

HIGH 7.1 CVSS 3.1
Published
November 14, 2022
Last modified
June 17, 2026
NVD status
Modified
Reported by
security@php.net
Weakness
CWE-131, CWE-190, CWE-125
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H

Description

In PHP versions prior to 7.4.33, 8.0.25 and 8.1.12, when using imageloadfont() function in gd extension, it is possible to supply a specially crafted font file, such as if the loaded font is used with imagechar() function, the read outside allocated buffer will be used. This can lead to crashes or disclosure of confidential information. 

Affected products and versions

  • PHP — From 7.4.0 (including) to 7.4.33 (excluding)
  • PHP — From 8.0.0 (including) to 8.0.25 (excluding)
  • PHP — From 8.1.0 (including) to 8.1.12 (excluding)

References

  • bugs.php.net https://bugs.php.net/bug.php?id=81739 Exploit, Issue Tracking, Patch, Vendor Advisory
  • nvd.nist.gov Official NVD record