Heap-buffer-overflow in _zend_is_inconsistent in php

php Updated 02 Oct 2025

Summary

04/12/2020

Disclosed on

MEDIUM

Severity

Yes i

Fix available

Medium

Severity

Not published

CVSS Score

OSV-2020-2230: Heap-buffer-overflow in _zend_is_inconsistent. Affects php versions >= 8b37c1e993f17345312a76a239b77ae137d3f8e8, < f06afc434aec631f18f8da8ffca9a6f0559e1acf. Fixed in f06afc434aec631f18f8da8ffca9a6f0559e1acf. How to fix ↓

Free scan

Check if this vulnerability affects your application

Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.

Check my app free

No signup required · Results in about 60 seconds

Upload your dependency manifest or SBOM

Drag & drop your file here or Browse

Java Javascript PHP Python Go Rust Ruby Dart C/C++ Elixir CycloneDX SPDX

Upload a supported dependency manifest or SBOM. No installation or source-code access required.

See supported files and SBOM formats

SBOM sbom.json · bom.json · bom.xml · *.spdx.json · *.cdx.json · *.cdx.xml

Java pom.xml · gradle.lockfile · buildscript-gradle.lockfile

Javascript package-lock.json · yarn.lock · pnpm-lock.yaml

PHP composer.lock

Python poetry.lock · requirements.txt · Pipfile.lock

Go go.mod

Rust Cargo.lock

Ruby Gemfile.lock

Dart pubspec.lock

C/C++ conan.lock

Elixir mix.lock

Enter your work email to receive your report link.

Verify your email to view the full report and start 30 days of continuous monitoring. No credit card required.

Background

PHP is a popular general-purpose scripting language widely used for web development. It is known for its simplicity, flexibility, and extensive support for various databases. The vulnerability in question affects the PHP package and is related to a heap-buffer-overflow in the _zend_is_inconsistent function. This function is responsible for checking the consistency of the Zend Engine's data structures. The vulnerability can lead to a heap-buffer-overflow read of 4 bytes.

Vulnerability Detail

The vulnerability originates from a heap-buffer-overflow read of 4 bytes in the _zend_is_inconsistent function. This can be triggered when the function is called and can potentially result in a crash. The vulnerability has a medium severity rating and was reported through the OSS-Fuzz project. The impact of this vulnerability could vary depending on the specific usage scenario, but it has the potential to be exploited by an attacker to execute arbitrary code or cause a denial-of-service condition.

How To Fix

Minimum fixed version

f06afc434aec631f18f8da8ffca9a6f0559e1acf

This is the first release that contains the fix.

Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →

Workaround

At the moment, no specific workaround has been provided for this vulnerability. It is recommended to apply the fix mentioned in the 'how_to_fix' section as soon as possible.

Conclusion

In conclusion, the PHP package is affected by a heap-buffer-overflow vulnerability in the _zend_is_inconsistent function. This vulnerability can potentially be exploited to execute arbitrary code or cause a denial-of-service condition. It is crucial to update to a version of PHP that includes the fix to mitigate this vulnerability. For further support on vulnerability remediation, you can reach out to DevNack.com.

See every vulnerability recorded for php →