CVE-2018-6345

CVE-2018-6345

Vendor Facebook
Product HHVM
Weakness CWE-122
Published January 15, 2019
Last update August 5, 2024
View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

The function number_format is vulnerable to a heap overflow issue when its second argument ($dec_points) is excessively large. The internal implementation of the function will cause a string to be created with an invalid length, which can then interact poorly with other functions. This affects all supported versions of HHVM (3.30.1 and 3.27.5 and below).

Key dates

02Disclosure timeline

January 15, 2019 CVE published
August 5, 2024 Record updated

Related vulnerabilities

04Related CVE

CVE-2025-48824 Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability CVE-2023-25898 ZDI-CAN-19521: Adobe Dimension USD File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability CVE-2023-26416 ZDI-CAN-20318: Adobe Substance 3D Designer DAE File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability CVE-2026-34701 InDesign Desktop | Heap-based Buffer Overflow (CWE-122) CVE-2024-3207 ermig1979 Simd SimdMemoryStream.h ReadUnsigned heap-based overflow