CVE-2020-7060

PoC —

CVSS 3.1

9.1 critical

EPSS

9%p95

Published

Feb 10, 2020 (Feb 10, 2020)

Modified

Jun 17, 2026

Description

When using certain mbstring functions to convert multibyte encodings, in PHP versions 7.2.x below 7.2.27, 7.3.x below 7.3.14 and 7.4.x below 7.4.2 it is possible to supply data that will cause function mbfl_filt_conv_big5_wchar to read past the allocated buffer. This may lead to information disclosure or crash.

Vendors: php tenable oracle opensuse debian
Products: php, tenable.sc, communications diameter signaling router, leap, debian linux
Weakness: CWE-125
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

NVD CVE.org GitHub PoCs EPSS (8.9%)

In the news0 stories

No ingested article mentions this CVE yet.