CVE-2016-6871
Integer overflow in bcmath in Facebook HHVM before 3.15.0 allows attackers to have unspecified...
CVE-2016-6871 is a critical vulnerability (CVSS 9.8) in Facebook Hhvm, published February 17, 2017. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.33%, the 83rd percentile. No source names a fixed version.
Integer overflow in bcmath in Facebook HHVM before 3.15.0 allows attackers to have unspecified impact via unknown vectors, which triggers a buffer overflow.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
Integer overflow in bcmath in Facebook HHVM before 3.15.0 allows attackers to have unspecified impact via unknown vectors, which triggers a buffer overflow.
- Record
CVE-2016-6871- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-190
- Updated
- 2026-11-02
CVE List No score
Integer overflow in bcmath in Facebook HHVM before 3.15.0 allows attackers to have unspecified impact via unknown vectors, which triggers a buffer overflow.
- Record
CVE-2016-6871- Updated
- 2026-11-02
EUVDEUVD-2016-7756 No score
Integer overflow in bcmath in Facebook HHVM before 3.15.0 allows attackers to have unspecified impact via unknown vectors, which triggers a buffer overflow.
- Record
EUVD-2016-7756- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-69p6-g3px-hvhw
Integer overflow in bcmath in Facebook HHVM before 3.15.0 allows attackers to have unspecified...
Integer overflow in bcmath in Facebook HHVM before 3.15.0 allows attackers to have unspecified impact via unknown vectors, which triggers a buffer overflow.
- Record
GHSA-69p6-g3px-hvhw- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-190
- Updated
- 2026-11-02
OSV
Integer overflow in bcmath in Facebook HHVM before 3.15.0 allows attackers to have unspecified impact via unknown vectors, which triggers a buffer overflow.
- Record
CVE-2016-6871- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2016-6871
Integer overflow in bcmath in Facebook HHVM before 3.15.0 allows attackers to have unspecified impact via unknown vectors, which triggers a buffer overflow.
- Record
UBUNTU-CVE-2016-6871- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
hhvmUbuntu:16.04:LTS |
All versions, plus listed versions 3.11.0+dfsg-13.11.1+dfsg-13.11.1+dfsg-1ubuntu1 |
None known |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |
References
openwall.com/lists/oss-security/2016/08/11/1
github.com/facebook/hhvm/commit/c00fc9d3003eb06226b58b6a48555f1456ee2475
nvd.nist.gov/vuln/detail/CVE-2016-6871
ubuntu.com/security/CVE-2016-6871
cve.org/CVERecord?id=CVE-2016-6871