Heap-based buffer overflow in PHP - CVE-2016-4346
Published: July 20, 2022 / Updated: June 8, 2025
Vulnerability identifier: #VU110266
CSH Severity: High
CVSSv4.0:
CVE-ID: CVE-2016-4346
CWE-ID: CWE-122
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerable software:
PHP
PHP
Software vendor:
PHP Group
PHP Group
Description
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error in Integer overflow in the str_pad function in ext/standard/string.c in PHP before 7.0.4. A remote attacker can use a long string to trigger a heap-based buffer overflow and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
Remediation
Install update from vendor's website.