The function number_format is vulnerable to a heap overflow issue when its second argument ($dec_points) is excessively large.

Published 7 y ago 2019-01-15 · modified 4 mo ago 2026-06-17 · JSON

CVSS

9.8

v3.1 · NVD

CISA KEV

not known exploited

EPSS

1.7%

percentile 78%

Public exploits

none known

The function number_format is vulnerable to a heap overflow issue when its second argument ($dec_points) is excessively large. The internal implementation of the function will cause a string to be created with an invalid length, which can then interact poorly with other functions. This affects all supported versions of HHVM (3.30.1 and 3.27.5 and below).

Exploit prediction (EPSS)

1.75% probability of exploitation in the next 30 days, higher than 78% of all scored CVEs.

CVSS scores

Assigned by	Version	Score	Vector
NVD	3.1	9.8	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`
NVD	2.0	7.5	`AV:N/AC:L/Au:N/C:P/I:P/A:P`

Affected products

Facebook HHVM

Classification

Weakness

CWE-122 Heap-based Buffer Overflow
CWE-787 Out-of-bounds Write

References

github.com /facebook/hhvm/commit/190ffdf6c8b1ec443be202c7d69e63a7e3da25e3 · x_refsource_MISC, x_transferred
hhvm.com /blog/2019/01/14/hhvm-3.30.2.html · x_refsource_MISC, x_transferred

Sources

CVE List: CVE-2018-6345
NVD: CVE-2018-6345

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.