QwikSec

Security Database

CVE

CWE

Training

CVE Database
/

CVE-2024-11235

Back to search

CVE-2024-11235

Published: Apr 4, 2025

Modified: Feb 26, 2026

PUBLISHED

Description

In PHP versions 8.3.* before 8.3.19 and 8.4.* before 8.4.5, a code sequence involving __set handler or ??=  operator and exceptions can lead to a use-after-free vulnerability. If the third party can control the memory layout leading to this, for example by supplying specially crafted inputs to the script, it could lead to remote code execution.

VendorProductVersions

PHP Group

PHP

affected
8.4.* - < 8.4.5
affected
8.3.* - < 8.3.19

Weaknesses (CWE)

CWE-416

References

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Start Training

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.

Scan Now