mb_strtolower (UTF-32LE): stack-buffer-overflow at php_unicode_tolower_full

An attacker can exploit CVE-2020-7065 by crafting a malicious string encoded in UTF-32LE and passing it to the mb_strtolower() function. The resulting buffer overflow can overwrite critical data on the stack, potentially allowing the attacker to hijack control flow and execute arbitrary code. The severity of this vulnerability is high due to the potential for remote code execution. Successful exploitation could lead to complete compromise of the affected PHP application and the underlying server. This is particularly concerning in web applications where user input is directly processed by PHP scripts.

1. Reserviert2020-01-15
2. Veröffentlicht2020-04-01
3. Geändert2024-09-17
4. EPSS aktualisiert2026-04-02

The primary mitigation for CVE-2020-7065 is to upgrade to PHP version 7.4.4 or later. If an immediate upgrade is not possible, carefully review and sanitize all user input before passing it to the mb_strtolower() function, especially when dealing with UTF-32LE encoded strings. Consider using alternative string manipulation functions that are less susceptible to buffer overflows. Web Application Firewalls (WAFs) can be configured to detect and block requests containing potentially malicious UTF-32LE encoded strings. After upgrading, confirm the fix by attempting to process a known malicious UTF-32LE string and verifying that no stack overflow occurs.