CVE-2016-1000005

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2020-02-19 · updated 2026-06-17
Weakness: CWE-843

Description

mcrypt_get_block_size did not enforce that the provided "module" parameter was a string, leading to type confusion if other types of data were passed in. This issue affects HHVM versions prior to 3.9.5, all versions between 3.10.0 and 3.12.3 (inclusive), and all versions between 3.13.0 and 3.14.1 (inclusive).

Affected products

Facebook HHVM: before 3.9.5; from 3.10.0 through 3.12.3; from 3.13.0 through 3.14.1 — fixed in 3.9.5

How to fix

Upgrade to a fixed version: Facebook HHVM 3.9.5. Check the vendor advisory for mitigations.

References

https://github.com/facebook/hhvm/commit/39e7e177473350b3a5c34e8824af3b98e25efa89
https://www.facebook.com/security/advisories/cve-2016-1000005
https://github.com/facebook/hhvm/commit/39e7e177473350b3a5c34e8824af3b98e25efa89
https://www.facebook.com/security/advisories/cve-2016-1000005

Get alerted when CVE-2016-1000005 or the next vulnerability affects your stack