CVE-2019-11935 — Insufficient boundary checks when processing a string in mb_ereg_replace allows access to out-of-bounds memory

Back Back to CVE browser

CRITICAL

Insufficient boundary checks when processing a string in mb_ereg_replace allows access to out-of-bounds memory

Published Dec 4, 2019

9.8

CRITICAL

CVSS 3.1

EPSS 1.48%

Description

Insufficient boundary checks when processing a string in mb_ereg_replace allows access to out-of-bounds memory. This issue affects HHVM versions prior to 3.30.12, all versions between 4.0.0 and 4.8.5, all versions between 4.9.0 and 4.23.1, as well as 4.24.0, 4.25.0, 4.26.0, 4.27.0, 4.28.0, and 4.28.1.

Affected products

Vendor Facebook Product HHVM Default
n/a
- Version
  3.30.12
  Status
  affected
  Constraints
  -
- Version
  4.0.0
  Status
  affected
  Constraints
  <unspecified
- Version
  4.23.2
  Status
  affected
  Constraints
  -
- Version
  4.24.0
  Status
  affected
  Constraints
  <unspecified
- Version
  4.24.1
  Status
  affected
  Constraints
  -
- Version
  4.25.0
  Status
  affected
  Constraints
  <unspecified
- Version
  4.25.1
  Status
  affected
  Constraints
  -
- Version
  4.26.0
  Status
  affected
  Constraints
  <unspecified
- Version
  4.26.1
  Status
  affected
  Constraints
  -
- Version
  4.27.0
  Status
  affected
  Constraints
  <unspecified
- Version
  4.27.1
  Status
  affected
  Constraints
  -
- Version
  4.28.0
  Status
  affected
  Constraints
  <unspecified
- Version
  4.28.2
  Status
  affected
  Constraints
  -
- Version
  4.8.6
  Status
  affected
  Constraints
  -
- Version
  4.9.0
  Status
  affected
  Constraints
  <unspecified
- Version
  unspecified
  Status
  affected
  Constraints
  <3.30.12

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Facebook

HHVM

n/a

Version	Status	Constraints
3.30.12	affected	-
4.0.0	affected	<unspecified
4.23.2	affected	-
4.24.0	affected	<unspecified
4.24.1	affected	-
4.25.0	affected	<unspecified
4.25.1	affected	-
4.26.0	affected	<unspecified
4.26.1	affected	-
4.27.0	affected	<unspecified
4.27.1	affected	-
4.28.0	affected	<unspecified
4.28.2	affected	-
4.8.6	affected	-
4.9.0	affected	<unspecified
unspecified	affected	<3.30.12

Remediation

No remediation recorded yet.

Metrics

1.48% 0.01476

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 3, 2026.

EPSS probability 0.01476

Score over time

2021–2026

EPSS v1
EPSS v5
EPSS v2
EPSS v3

Percentile over time

EPSS v1
EPSS v5
EPSS v2
EPSS v3

Table of values (14 key points)

Flat stretches are collapsed; showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 3, 2026	1.48% (0.01476)	72.96th	v5 (v2026.06.15)
Sep 20, 2026	1.48% (0.01476)	72.70th	v5 (v2026.06.15)
Jul 20, 2024	0.50% (0.00499)	76.55th	v3 (v2023.03.01)
Feb 8, 2024	0.50% (0.00499)	75.61th	v3 (v2023.03.01)
Oct 8, 2023	0.50% (0.00499)	73.56th	v3 (v2023.03.01)
Sep 23, 2023	0.35% (0.00352)	68.55th	v3 (v2023.03.01)
Mar 7, 2023	0.29% (0.00295)	64.37th	v3 (v2023.03.01)
Mar 6, 2023	0.95% (0.00954)	36.37th	v2 (v2022.01.01)
Apr 1, 2022	0.95% (0.00954)	32.50th	v2 (v2022.01.01)
Feb 4, 2022	12.49% (0.12492)	89.83th	v2 (v2022.01.01)
Feb 3, 2022	3.63% (0.03630)	71.73th	v1
Jan 6, 2022	3.63% (0.03630)	71.48th	v1
Jan 5, 2022	0.83% (0.00833)	58.90th	v5 (v2026.06.15)
Apr 14, 2021	0.83% (0.00833)	0.00th	v1

Weaknesses (2)

CWE-120

Classic Buffer Overflow

CWE-125

Out-of-bounds Read

References (3)

https://github.com/facebook/hhvm/commit/1c518555dba6ceb45d5ba61845b96e261219c3b7
x_refsource_CONFIRMPatchThird Party Advisory
https://hhvm.com/blog/2019/10/28/security-update.html
x_refsource_CONFIRMVendor Advisory
https://www.facebook.com/security/advisories/cve-2019-11935
x_refsource_CONFIRMVendor Advisory

Link	Providers	Tags
https://github.com/facebook/hhvm/commit/1c518555dba6ceb45d5ba61845b96e261219c3b7		x_refsource_CONFIRMPatchThird Party Advisory
https://hhvm.com/blog/2019/10/28/security-update.html		x_refsource_CONFIRMVendor Advisory
https://www.facebook.com/security/advisories/cve-2019-11935		x_refsource_CONFIRMVendor Advisory