What is CVE-2022-31630?

CVE-2022-31630 is a medium-severity vulnerability in Php, classified under Incorrect Calculation of Buffer Size. CVSS score: 6.5/10. Published 2022-11-14.

How severe is CVE-2022-31630?

Medium severity. CVSS v3 base score is 6.5 out of 10.

Is CVE-2022-31630 known to be exploited?

6 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Out-of-bounds Read in Php

CVE-2022-31630

In PHP versions prior to 7.4.33, 8.0.25 and 8.1.12, when using imageloadfont() function in gd extension, it is possible to supply a specially crafted font file, such as if the loaded font is used with imagechar() function, the read outside allocated buffer will be used. This can lead to crashes or disclosure of confidential information.

EPSS: 0.022 (80.7th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L.

Affected products

Php
Php Group — versions 7.4.x, 8.0.x, 8.1.x

Weakness classification (CWE)

Public proof-of-concept exploits

References

security@php.net (Exploit, Patch, Issue Tracking, Vendor Advisory)

Frequently asked questions

What is CVE-2022-31630?: CVE-2022-31630 is a medium-severity vulnerability in Php, classified under Incorrect Calculation of Buffer Size. CVSS score: 6.5/10. Published 2022-11-14.
How severe is CVE-2022-31630?: Medium severity. CVSS v3 base score is 6.5 out of 10.
Is CVE-2022-31630 known to be exploited?: 6 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.