BlackTreeCVE IntelligencePHP · FastCGI Process Manager (FPM)
CISA confirms exploitation in the wild and lists 2022-04-15 as the remediation due date.
CISA confirms exploitation in the wild and lists 2022-04-15 as the remediation due date.
Patch availableIn some versions of PHP in certain configurations of FPM setup, it is possible to cause FPM module to write past allocated buffers allowing the possibility of remote code execution.
In some versions of PHP in certain configurations of FPM setup, it is possible to cause FPM module to write past allocated buffers allowing the possibility of remote code execution.
The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer.
An attacker operating through a network path may attempt exploitation without authentication or user interaction. If successful, the issue may execute code or commands in the affected security context.
In some versions of PHP in certain configurations of FPM setup, it is possible to cause FPM module to write past allocated buffers allowing the possibility of remote code execution.
The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer.
An attacker operating through a network path may attempt exploitation without authentication or user interaction. If successful, the issue may execute code or commands in the affected security context.
CVSS severity, EPSS forecast probability, public exploit material and CISA-confirmed exploitation are separate signals.
CISA added this CVE to its Known Exploited Vulnerabilities catalogue on 2022-03-25. Known ransomware campaign use is recorded.
A structured CVE source labels at least one public reference as exploit material. BlackTree has not independently validated that it is safe, reliable or weaponised.
CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow'). The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:NCommon Vulnerability Scoring System 3.1: the compact vector below is decoded into plain language.
Operational remediation based on structured source evidence.
Published 28 Oct 2019 · Last source change 21 Oct 2025, 23:45 UTC · CWE-120 · Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
Core structured fields are present and their contributing authorities are shown above.