CVE-2024-11233

Single byte overread with convert.quoted-printable-decode filter

State: Published
Severity: 4.8 Medium
Published: Nov 24, 2024
Updated: Nov 3, 2025
Reserved: Nov 15, 2024

Description

In PHP versions 8.1.* before 8.1.31, 8.2.* before 8.2.26, 8.3.* before 8.3.14, due to an error in convert.quoted-printable-decode filter certain data can lead to buffer overread by one byte, which can in certain circumstances lead to crashes or disclose content of other memory areas.

Scores

CVSS	Score	Vector	Source
3.1	4.8 Medium	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L	php

Weaknesses

CWE-122 Heap-based Buffer Overflow

Affected Products

Product	Versions
PHPPHP Group	8.1.* to before 8.1.31Affected 8.2.* to before 8.2.26Affected 8.3.* to before 8.3.14Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.