CVE-2019-9025

Severity: critical (CVSS 9.8 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 3.1% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2019-02-22 · updated 2026-06-17
Weakness: CWE-125

Description

An issue was discovered in PHP 7.3.x before 7.3.1. An invalid multibyte string supplied as an argument to the mb_split() function in ext/mbstring/php_mbregex.c can cause PHP to execute memcpy() with a negative argument, which could read and write past buffers allocated for the data.

Affected products

NetApp Storage Automation Store: all versions
PHP: from 7.3.0 before 7.3.1 — fixed in 7.3.1

How to fix

Upgrade to a fixed version: PHP 7.3.1. Check the vendor advisory for mitigations.

References

https://bugs.php.net/bug.php?id=77367
https://security.netapp.com/advisory/ntap-20190321-0001/
https://bugs.php.net/bug.php?id=77367
https://security.netapp.com/advisory/ntap-20190321-0001/

Get alerted when CVE-2019-9025 or the next vulnerability affects your stack