blogsafe.org My Downloads

BlogSafe.org

PHP CVEs

Vulnerabilities in the PHP language itself, and which PHP versions they affect.

← Back to CVE list

CVE-2024-11235

CRITICAL 9.2 CVSS 4.0
Published
April 4, 2025
Last modified
June 17, 2026
NVD status
Analyzed
Reported by
security@php.net
Weakness
CWE-416
CVSS vector
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Amber

Description

In PHP versions 8.3.* before 8.3.19 and 8.4.* before 8.4.5, a code sequence involving __set handler or ??=  operator and exceptions can lead to a use-after-free vulnerability. If the third party can control the memory layout leading to this, for example by supplying specially crafted inputs to the script, it could lead to remote code execution.

Affected products and versions

  • PHP — From 8.3.0 (including) to 8.3.19 (excluding)
  • PHP — From 8.4.0 (including) to 8.4.5 (excluding)

References

  • github.com https://github.com/php/php-src/security/advisories/GHSA-rwp7-7vc6-8477 Exploit, Vendor Advisory
  • nvd.nist.gov Official NVD record