BIT-libphp-2022-31627

vendorUSosv

Heap buffer overflow in finfo_buffer

view advisory published 2025-08-11Licence: per source

In PHP versions 8.1.x below 8.1.8, when fileinfo functions, such as finfo_buffer, due to incorrect patch applied to the third party code from libmagic, incorrect function may be used to free allocated memory, which may lead to heap corruption.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2022-31627US	critical9.8	2.14% (82nd)	—	2022-07-28
In PHP versions 8.1.x below 8.1.8, when fileinfo functions, such as finfo_buffer, due to incorrect patch applied to the third party code from libmagic, incorrect function may be us…

references

External citations — patches, advisories, analysis.

https://bugs.php.net/bug.php?id=81723ADVISORY
https://nvd.nist.gov/vuln/detail/CVE-2022-31627WEB
https://security.gentoo.org/glsa/202209-20ADVISORY
https://security.netapp.com/advisory/ntap-20220826-0008/ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan