Platform
php
Component
php
Fixed in
7.2.26
7.3.13
7.4.1
CVE-2019-11046 is a memory disclosure vulnerability discovered in the PHP bcmath extension. This flaw allows attackers to potentially read beyond the allocated memory space when processing specially crafted input strings. The vulnerability impacts PHP versions 7.2.x prior to 7.2.26, 7.3.x prior to 7.3.13, and 7.4.0. A fix is available in PHP 7.4.1.
Successful exploitation of CVE-2019-11046 could allow an attacker to read sensitive information from the server's memory. While the vulnerability is rated as LOW severity, the potential for information disclosure is significant. An attacker could potentially gain access to configuration files, database credentials, or other sensitive data stored in memory. The impact is amplified if the server hosts web applications handling sensitive user data, as the attacker could potentially correlate memory contents with application behavior to infer further information. This vulnerability is particularly concerning on Windows systems due to the specific OS-level character identification behavior exploited.
CVE-2019-11046 was publicly disclosed on December 23, 2019. There is no indication of active exploitation campaigns targeting this vulnerability at this time. Public proof-of-concept exploits are available, demonstrating the feasibility of exploiting the memory disclosure. The vulnerability has not been added to the CISA KEV catalog.
Exploit Status
EPSS
8.24% (92% percentile)
CVSS Vector
The primary mitigation for CVE-2019-11046 is to upgrade to a patched version of PHP. Upgrade to PHP 7.4.1 or later to eliminate the vulnerability. If upgrading is not immediately feasible, consider implementing temporary workarounds such as input validation to sanitize data passed to bcmath functions. While not a complete solution, this can reduce the attack surface. Monitor PHP error logs for unusual activity related to bcmath functions. After upgrading, confirm the fix by attempting to trigger the vulnerability with a known malicious input string and verifying that it no longer results in memory disclosure.
Update to the latest version of PHP. If you are using PHP 7.2.x, update to version 7.2.26 or higher. If you are using PHP 7.3.x, update to version 7.3.13 or higher. If you are using PHP 7.4.0, update to version 7.4.1 or higher.
Vulnerability analysis and critical alerts directly to your inbox.
CVE-2019-11046 is a vulnerability in PHP's bcmath extension that allows attackers to read beyond allocated memory, potentially exposing sensitive data. It affects PHP versions 7.2.0–7.4.1 and is rated as LOW severity.
You are affected if you are running PHP versions 7.2.x prior to 7.2.26, 7.3.x prior to 7.3.13, or 7.4.0. Check your PHP version and upgrade if necessary.
Upgrade to PHP 7.4.1 or later to resolve the vulnerability. If upgrading is not possible, implement input validation for bcmath functions as a temporary workaround.
There is no current evidence of active exploitation campaigns targeting CVE-2019-11046, but public proof-of-concept exploits exist.
Refer to the official PHP security advisory: https://security.php.net/CVE-2019-11046
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.