CVE-2019-11046

Low

No strong exploitation signal.

CVSS base

3.7 LOW

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

EPSS — probability of exploitation (30 days)

4.1%

90.2th percentile

CISA KEV

Not listed

Weakness / dates

CWE-125

Published 2019-12-23 · modified 2026-08-17

CVSS breakdown

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Attack Vector	N	Network
Attack Complexity	H	High
Privileges Required	N	None
User Interaction	N	None
Scope	U	Unchanged
Confidentiality	L	Low
Integrity	N	None
Availability	N	None

Timeline

2019-12-23 — Published (NVD)
2026-08-17 — Last modified (NVD)

Description

In PHP versions 7.2.x below 7.2.26, 7.3.x below 7.3.13 and 7.4.0, PHP bcmath extension functions on some systems, including Windows, can be tricked into reading beyond the allocated space by supplying it with string containing characters that are identified as numeric by the OS but aren't ASCII numbers. This can read to disclosure of the content of some memory locations.

Affected

canonical debian fedoraproject opensuse php tenable

References

Official: NVD · CVE.org