CVE-2017-9118 — php: Out of bounds access in php_pcre.c:php_pcre_replace_impl()

HIGH

php: Out of bounds access in php_pcre.c:php_pcre_replace_impl()

Published Aug 2, 2018

7.5

HIGH

CVSS 3.1

EPSS 2.95%

PHP 7.1.5 has an Out of bounds access in php_pcre_replace_impl via a crafted preg_replace call.

Red Hat Software Collections for Red Hat Enterprise Linux 7

rh-php71-php-0:7.1.30-1.el7

Fixed · RHSA-2019:2519
Red Hat Software Collections for Red Hat Enterprise Linux 7.4 EUS

rh-php71-php-0:7.1.30-1.el7

Fixed · RHSA-2019:2519
Red Hat Software Collections for Red Hat Enterprise Linux 7.5 EUS

rh-php71-php-0:7.1.30-1.el7

Fixed · RHSA-2019:2519
Red Hat Software Collections for Red Hat Enterprise Linux 7.6 EUS

rh-php71-php-0:7.1.30-1.el7

Fixed · RHSA-2019:2519
Red Hat Enterprise Linux 5

php

Not affected
Red Hat Enterprise Linux 5

php53

Will not fix
Red Hat Enterprise Linux 6

php

Will not fix
Red Hat Enterprise Linux 7

php

Affected
Red Hat Enterprise Linux 8

php

Will not fix
Red Hat Software Collections

rh-php70-php

Affected
Red Hat Software Collections

rh-php72-php

Affected

Product	Package	State	Advisory
Red Hat Software Collections for Red Hat Enterprise Linux 7	rh-php71-php-0:7.1.30-1.el7	Fixed	RHSA-2019:2519
Red Hat Software Collections for Red Hat Enterprise Linux 7.4 EUS	rh-php71-php-0:7.1.30-1.el7	Fixed	RHSA-2019:2519
Red Hat Software Collections for Red Hat Enterprise Linux 7.5 EUS	rh-php71-php-0:7.1.30-1.el7	Fixed	RHSA-2019:2519
Red Hat Software Collections for Red Hat Enterprise Linux 7.6 EUS	rh-php71-php-0:7.1.30-1.el7	Fixed	RHSA-2019:2519
Red Hat Enterprise Linux 5	php	Not affected	n/a
Red Hat Enterprise Linux 5	php53	Will not fix	n/a
Red Hat Enterprise Linux 6	php	Will not fix	n/a
Red Hat Enterprise Linux 7	php	Affected	n/a
Red Hat Enterprise Linux 8	php	Will not fix	n/a
Red Hat Software Collections	rh-php70-php	Affected	n/a
Red Hat Software Collections	rh-php72-php	Affected	n/a

No remediation recorded yet.

2.95% 0.02954

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 1, 2026.

EPSS probability 0.02954

2021–2026

Table of values (14 key points)

Flat stretches are collapsed; showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 1, 2026	2.95% (0.02954)	86.69th	v5 (v2026.06.15)
Jun 15, 2026	2.95% (0.02954)	85.34th	v5 (v2026.06.15)
Jul 20, 2024	0.22% (0.00222)	60.96th	v3 (v2023.03.01)
Dec 24, 2023	0.22% (0.00222)	60.47th	v3 (v2023.03.01)
Jul 27, 2023	0.24% (0.00241)	61.13th	v3 (v2023.03.01)
Mar 7, 2023	0.21% (0.00210)	57.12th	v3 (v2023.03.01)
Mar 6, 2023	0.95% (0.00954)	36.37th	v2 (v2022.01.01)
Sep 2, 2022	0.95% (0.00954)	34.50th	v2 (v2022.01.01)
Apr 1, 2022	0.95% (0.00954)	32.50th	v2 (v2022.01.01)
Feb 4, 2022	0.95% (0.00954)	16.28th	v2 (v2022.01.01)
Feb 3, 2022	0.83% (0.00833)	24.58th	v1
Jan 6, 2022	0.83% (0.00833)	23.96th	v1
Sep 1, 2021	0.83% (0.00833)	57.50th	v1
Apr 14, 2021	0.83% (0.00833)	0.00th	v1

Weaknesses (2)

CWE-125

Out-of-bounds Read

CWE-400

Uncontrolled Resource Consumption

Link	Providers	Tags
https://access.redhat.com/errata/RHSA-2019:2519		vendor-advisoryx_refsource_REDHATThird Party Advisory
https://access.redhat.com/security/cve/CVE-2017-9118		Vendor Advisory
https://bugs.php.net/bug.php?id=74604		x_refsource_MISCExploitIssue TrackingVendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1611890		Issue Tracking
https://nvd.nist.gov/vuln/detail/CVE-2017-9118
https://security.netapp.com/advisory/ntap-20181107-0003/		x_refsource_CONFIRMThird Party Advisory
https://www.cve.org/CVERecord?id=CVE-2017-9118