CVE-2017-12932
Status: ModifiedCritical (9.8)—
ext/standard/var_unserializer.re in PHP 7.0.x through 7.0.22 and 7.1.x through 7.1.8 is prone to a heap use after free while unserializing untrusted data, related to improper use of the hash API for key deletion in a situation with an invalid array size. Exploitation of this issue can have an unspecified impact on the integrity of PHP.
CVSS
- Version: 3.0
- Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Base score: 9.8
Exploitation probability (EPSS)
- Probability of exploitation in the next 30 days: 7.42%
- Percentile among all scored CVEs: 94
- Score date: 10/17/2026
EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).
Affected technologies (1)
CWEs
- CWE-416
References
- http://php.net/ChangeLog-7.php
- http://www.securityfocus.com/bid/100427
- https://access.redhat.com/errata/RHSA-2018:1296
- https://access.redhat.com/errata/RHSA-2019:2519
- https://bugs.php.net/bug.php?id=74103
- https://github.com/php/php-src/commit/1a23ebc1fff59bf480ca92963b36eba5c1b904c4
- https://security.gentoo.org/glsa/201709-21
- https://security.netapp.com/advisory/ntap-20180112-0001/
- https://www.debian.org/security/2018/dsa-4080
- http://php.net/ChangeLog-7.php
- http://www.securityfocus.com/bid/100427
- https://access.redhat.com/errata/RHSA-2018:1296
- https://access.redhat.com/errata/RHSA-2019:2519
- https://bugs.php.net/bug.php?id=74103
- https://github.com/php/php-src/commit/1a23ebc1fff59bf480ca92963b36eba5c1b904c4
- https://security.gentoo.org/glsa/201709-21
- https://security.netapp.com/advisory/ntap-20180112-0001/
- https://www.debian.org/security/2018/dsa-4080
Raw JSON (NVD)
Show
{
"id": "CVE-2017-12932",
"cveTags": [],
"metrics": {
"cvssMetricV2": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"version": "2.0",
"baseScore": 7.5,
"accessVector": "NETWORK",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"authentication": "NONE",
"integrityImpact": "PARTIAL",
"accessComplexity": "LOW",
"availabilityImpact": "PARTIAL",
"confidentialityImpact": "PARTIAL"
},
"acInsufInfo": true,
"impactScore": 6.4,
"baseSeverity": "HIGH",
"obtainAllPrivilege": false,
"exploitabilityScore": 10,
"obtainUserPrivilege": false,
"obtainOtherPrivilege": false,
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.0",
"baseScore": 9.8,
"attackVector": "NETWORK",
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"integrityImpact": "HIGH",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "HIGH",
"privilegesRequired": "NONE",
"confidentialityImpact": "HIGH"
},
"impactScore": 5.9,
"exploitabilityScore": 3.9
}
]
},
"affected": [
{
"source": "cve@mitre.org",
"affectedData": [
{
"vendor": "n/a",
"product": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
]
}
],
"published": "2017-08-18T03:29:00.183",
"references": [
{
"url": "http://php.net/ChangeLog-7.php",
"tags": [
"Release Notes",
"Vendor Advisory"
],
"source": "cve@mitre.org"
},
{
"url": "http://www.securityfocus.com/bid/100427",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"source": "cve@mitre.org"
},
{
"url": "https://access.redhat.com/errata/RHSA-2018:1296",
"source": "cve@mitre.org"
},
{
"url": "https://access.redhat.com/errata/RHSA-2019:2519",
"source": "cve@mitre.org"
},
{
"url": "https://bugs.php.net/bug.php?id=74103",
"tags": [
"Issue Tracking",
"Vendor Advisory"
],
"source": "cve@mitre.org"
},
{
"url": "https://github.com/php/php-src/commit/1a23ebc1fff59bf480ca92963b36eba5c1b904c4",
"tags": [
"Patch",
"Third Party Advisory"
],
"source": "cve@mitre.org"
},
{
"url": "https://security.gentoo.org/glsa/201709-21",
"source": "cve@mitre.org"
},
{
"url": "https://security.netapp.com/advisory/ntap-20180112-0001/",
"source": "cve@mitre.org"
},
{
"url": "https://www.debian.org/security/2018/dsa-4080",
"source": "cve@mitre.org"
},
{
"url": "http://php.net/ChangeLog-7.php",
"tags": [
"Release Notes",
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www.securityfocus.com/bid/100427",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://access.redhat.com/errata/RHSA-2018:1296",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://access.redhat.com/errata/RHSA-2019:2519",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://bugs.php.net/bug.php?id=74103",
"tags": [
"Issue Tracking",
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://github.com/php/php-src/commit/1a23ebc1fff59bf480ca92963b36eba5c1b904c4",
"tags": [
"Patch",
"Third Party Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://security.gentoo.org/glsa/201709-21",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://security.netapp.com/advisory/ntap-20180112-0001/",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://www.debian.org/security/2018/dsa-4080",
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
],
"vulnStatus": "Modified",
"weaknesses": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "CWE-416"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "ext/standard/var_unserializer.re in PHP 7.0.x through 7.0.22 and 7.1.x through 7.1.8 is prone to a heap use after free while unserializing untrusted data, related to improper use of the hash API for key deletion in a situation with an invalid array size. Exploitation of this issue can have an unspecified impact on the integrity of PHP."
},
{
"lang": "es",
"value": "Ext/standard/var_unserializer.re en PHP en en sus versiones 7.0.x hasta 7.0.22 y versiones 7.1.x hasta 7.1.8 es propenso a un uso de memoria dinámica antes de liberación (heap use after free) al deserializar datos que no son de confianza. Esto está relacionado con el uso incorrecto de la API hash para borrado de claves en una situación de tamaño de array no válido. La explotación de este problema puede tener un impacto sin especificar en la integridad de PHP."
}
],
"lastModified": "2026-06-17T01:04:09.673",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:php:php:7.0.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "DB6890AF-8A0A-46EE-AAD5-CF9AAE14A321"
},
{
"criteria": "cpe:2.3:a:php:php:7.0.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "6B90B947-7B54-47F3-9637-2F4AC44079EE"
},
{
"criteria": "cpe:2.3:a:php:php:7.0.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "35848414-BD5D-4164-84DC-61ABBB1C4152"
},
{
"criteria": "cpe:2.3:a:php:php:7.0.3:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "2B1F8402-8551-4F66-A9A7-81D472AB058E"
},
{
"criteria": "cpe:2.3:a:php:php:7.0.4:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "7A773E8E-48CD-4D35-A0FD-629BD9334486"
},
{
"criteria": "cpe:2.3:a:php:php:7.0.5:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "FC492340-79AF-4676-A161-079A97EC6F0C"
},
{
"criteria": "cpe:2.3:a:php:php:7.0.6:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "F1C2D8FE-C380-4B43-B634-A3DBA4700A71"
},
{
"criteria": "cpe:2.3:a:php:php:7.0.7:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "3EB58393-0C10-413C-8D95-6BAA8BC19A1B"
},
{
"criteria": "cpe:2.3:a:php:php:7.0.8:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "751F51CA-9D88-4971-A6EC-8C0B72E8E22B"
},
{
"criteria": "cpe:2.3:a:php:php:7.0.9:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "37B74118-8FC2-44CB-9673-A83DF777B2E6"
},
{
"criteria": "cpe:2.3:a:php:php:7.0.10:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "4D56A200-1477-40DA-9444-CFC946157C69"
},
{
"criteria": "cpe:2.3:a:php:php:7.0.11:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "FD0D1CCC-A857-4C15-899E-08F9255CEE34"
},
{
"criteria": "cpe:2.3:a:php:php:7.0.12:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "6745CC43-2836-4CD8-848F-EEA08AE9D5AC"
},
{
"criteria": "cpe:2.3:a:php:php:7.0.13:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "7BEB6696-14F9-4D9B-9974-B682FFBB828E"
},
{
"criteria": "cpe:2.3:a:php:php:7.0.14:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "04146390-021D-4147-9830-9EAA90D120A7"
},
{
"criteria": "cpe:2.3:a:php:php:7.0.15:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "5B124547-DC1D-4A92-B8AB-8A1900063786"
},
{
"criteria": "cpe:2.3:a:php:php:7.0.16:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "F45B2127-CF3D-4D59-9042-AE6DF2908319"
},
{
"criteria": "cpe:2.3:a:php:php:7.0.17:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "29A450E3-931F-4487-A76D-80A38210297A"
},
{
"criteria": "cpe:2.3:a:php:php:7.0.18:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "C099A0C4-883D-42ED-8359-FFD3ADD692A3"
},
{
"criteria": "cpe:2.3:a:php:php:7.0.19:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "ABD07432-5A23-491E-892E-42F0F58307D0"
},
{
"criteria": "cpe:2.3:a:php:php:7.0.20:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "19627ECC-9342-4917-8FCC-7757339E3242"
},
{
"criteria": "cpe:2.3:a:php:php:7.0.21:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "8FF89D76-3FB3-42FA-80FF-53C2E222F9E9"
},
{
"criteria": "cpe:2.3:a:php:php:7.0.22:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "AF27AF4F-68BB-465A-8668-44833A87D023"
},
{
"criteria": "cpe:2.3:a:php:php:7.1.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "0C68AA43-ED90-4B98-A5F8-4E210C2CC7CD"
},
{
"criteria": "cpe:2.3:a:php:php:7.1.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "2466D297-9442-40B0-A1A7-F9D166396CF8"
},
{
"criteria": "cpe:2.3:a:php:php:7.1.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "EADBF7EE-18DC-49F9-BF2F-A09BBAE76F45"
},
{
"criteria": "cpe:2.3:a:php:php:7.1.3:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "1726E9B6-A7FA-402B-A911-0CE81C623087"
},
{
"criteria": "cpe:2.3:a:php:php:7.1.4:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "C3670FF7-2CA3-41A4-92FE-0123497E4E87"
},
{
"criteria": "cpe:2.3:a:php:php:7.1.5:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "1C22CE03-DFE5-4CD3-B229-10B219A55434"
},
{
"criteria": "cpe:2.3:a:php:php:7.1.6:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "C258AF27-84DF-4FC3-A651-1349BB567FB9"
},
{
"criteria": "cpe:2.3:a:php:php:7.1.7:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "4E4E7085-5075-4682-BBDD-55BBF828167E"
},
{
"criteria": "cpe:2.3:a:php:php:7.1.8:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "C84BB8CA-DD39-44F6-8C9C-FF1467815B5E"
}
],
"operator": "OR"
}
]
}
],
"sourceIdentifier": "cve@mitre.org"
}