VULNERABILITY INTELLIGENCE

CVE-2022-31630

CVSS score6.5 MEDIUM

EPSS probability1.32%

CISA KEVNot currently listed

Published2022-11-14

Last modified2026-06-17

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L

Description

In PHP versions prior to 7.4.33, 8.0.25 and 8.1.12, when using imageloadfont() function in gd extension, it is possible to supply a specially crafted font file, such as if the loaded font is used with imagechar() function, the read outside allocated buffer will be used. This can lead to crashes or disclosure of confidential information.

Weakness classification

security@php.net: CWE-131
nvd@nist.gov: CWE-125

Primary references

security@php.net — Exploit, Issue Tracking, Patch, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108 — Exploit, Issue Tracking, Patch, Vendor Advisory