Internet Bug Bounty · Report #510025

Invalid Read on exif_process_SOFn

Validstatus

highseverity

6upvotes

10 Oct 2020disclosed

How it was found

This bug is present in exif_scan_thumbnail method of ext/exif/exif.c file.

Detailed description and steps to reproduce for this bug is present in bug report submitted to php.net. Bug Report : https://bugs.php.net/bug.php?id=77540 PHP version : 7.1.26 CVE-ID : 2019-9640

Impact

This bug may allow an attacker to read unintended data from memory.

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original