GHSA-g4fr-ffvg-p5w6
GitHub Security Advisory
⚠ Unreviewed
CRITICAL
Has CVE
Advisory Details
The function number_format is vulnerable to a heap overflow issue when its second argument ($dec_points) is excessively large. The internal implementation of the function will cause a string to be created with an invalid length, which can then interact poorly with other functions. This affects all supported versions of HHVM (3.30.1 and 3.27.5 and below).
Related CVEs
Key Information
9.0
/10
Dataset
Last updated: July 3, 2025 6:26 AM
Data from GitHub Advisory Database. This information is provided for research and educational purposes.