CVE-2024-11235

Reference counting in php_request_shutdown causes Use-After-Free

CRITICAL 9.2

En bref

Source: NVD
EPSS: EPSS 1.48 % · centile 74 (2026-10-28)
État: PUBLISHED
Publiée: 2025-04-04 17:51 UTC
Mise à jour: 2026-02-26 18:28 UTC
Attribuée par: php
Statut NVD: Analyzed

Description

In PHP versions 8.3.* before 8.3.19 and 8.4.* before 8.4.5, a code sequence involving __set handler or ??= operator and exceptions can lead to a use-after-free vulnerability. If the third party can control the memory layout leading to this, for example by supplying specially crafted inputs to the script, it could lead to remote code execution.

Faiblesses (CWE)

CWE-416 — Utilisation après libération

Références

https://github.com/php/php-src/security/advisories/GHSA-rwp7-7vc6-8477

Scores

Version	Score	Vecteur	Évalué par
CVSS 4.0	CRITICAL 9.2	CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/U:Amber	php
CVSS 4.0	CRITICAL 9.2	CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Amber	NVD · security@php.net (Secondary)
CVSS 3.1	HIGH 8.1	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H	NVD · nvd@nist.gov (Primary)

Références européennes

ENISA EUVD · EUVD-2024-54524
GCVE · GCVE-0-2024-11235

Avis du CERT-FR

CERTFR-2025-AVI-0209 — Multiples vulnérabilités dans PHP · cert.ssi.gouv.fr

Configurations affectées (CPE NVD)

cpe:2.3:a:php:php:*:*:*:*:*:*:*:* ≥ 8.3.0 < 8.3.19
cpe:2.3:a:php:php:*:*:*:*:*:*:*:* ≥ 8.4.0 < 8.4.5

Produits affectés

Produit	Versions
PHP Group · PHP	affected 8.4.* < 8.4.5 ; affected 8.3.* < 8.3.19

Sources

Source	Licence
CVE List (CVEProject cvelistV5)	CVE Program Terms of Use
EPSS (FIRST.org)	FIRST — attribution requested
ENISA EUVD	ENISA — reproduction authorised, source acknowledged
CERT-FR (ANSSI)	Licence Ouverte / Etalab 2.0
NVD (NIST) via fkie-cad/nvd-json-data-feeds	Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD