CVE-2022-31627
Heap buffer overflow in finfo_buffer
In PHP versions 8.1.x below 8.1.8, when fileinfo functions, such as finfo_buffer, due to incorrect patch applied to the third party code from libmagic, incorrect function may be used to free allocated memory, which may lead to heap corruption.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
Heap buffer overflow in finfo_buffer
In PHP versions 8.1.x below 8.1.8, when fileinfo functions, such as finfo_buffer, due to incorrect patch applied to the third party code from libmagic, incorrect function may be used to free allocated memory, which may lead to heap corruption.
- Record
CVE-2022-31627- CVSS 3.1
- 7.7 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L - Weakness
- CWE-590
- Updated
- 2026-11-02
EUVDEUVD-2022-53079
In PHP versions 8.1.x below 8.1.8, when fileinfo functions, such as finfo_buffer, due to incorrect patch applied to the third party code from libmagic, incorrect function may be used to free allocated memory, which may lead to heap corruption.
- Record
EUVD-2022-53079- CVSS 3.1
- 7.7 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-2c24-m9rj-gq8m
In PHP versions 8.1.x below 8.1.8, when fileinfo functions, such as finfo_buffer, due to...
In PHP versions 8.1.x below 8.1.8, when fileinfo functions, such as finfo_buffer, due to incorrect patch applied to the third party code from libmagic, incorrect function may be used to free allocated memory, which may lead to heap corruption.
- Record
GHSA-2c24-m9rj-gq8m- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-787
- Updated
- 2026-11-02
NVD
In PHP versions 8.1.x below 8.1.8, when fileinfo functions, such as finfo_buffer, due to incorrect patch applied to the third party code from libmagic, incorrect function may be used to free allocated memory, which may lead to heap corruption.
- Record
CVE-2022-31627- CVSS 3.1
- 7.7 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L - CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-590, CWE-787
- Updated
- 2026-11-02
OSV
Heap buffer overflow in finfo_buffer
In PHP versions 8.1.x below 8.1.8, when fileinfo functions, such as finfo_buffer, due to incorrect patch applied to the third party code from libmagic, incorrect function may be used to free allocated memory, which may lead to heap corruption.
- Record
CVE-2022-31627- CVSS 3.1
- 7.7 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L - Weakness
- CWE-590
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2022-31627
In PHP versions 8.1.x below 8.1.8, when fileinfo functions, such as finfo_buffer, due to incorrect patch applied to the third party code from libmagic, incorrect function may be used to free allocated memory, which may lead to heap corruption.
- Record
UBUNTU-CVE-2022-31627- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 3.1
- 7.7 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L - Updated
- 2026-11-02
Show 5 moreShow less
OSVBIT-libphp-2022-31627 No score
Heap buffer overflow in finfo_buffer
In PHP versions 8.1.x below 8.1.8, when fileinfo functions, such as finfo_buffer, due to incorrect patch applied to the third party code from libmagic, incorrect function may be used to free allocated memory, which may lead to heap corruption.
- Record
BIT-libphp-2022-31627- Updated
- 2026-11-02
OSVBIT-php-2022-31627 No score
Heap buffer overflow in finfo_buffer
In PHP versions 8.1.x below 8.1.8, when fileinfo functions, such as finfo_buffer, due to incorrect patch applied to the third party code from libmagic, incorrect function may be used to free allocated memory, which may lead to heap corruption.
- Record
BIT-php-2022-31627- Updated
- 2026-11-02
OSVBIT-php-min-2022-31627 No score
Heap buffer overflow in finfo_buffer
In PHP versions 8.1.x below 8.1.8, when fileinfo functions, such as finfo_buffer, due to incorrect patch applied to the third party code from libmagic, incorrect function may be used to free allocated memory, which may lead to heap corruption.
- Record
BIT-php-min-2022-31627- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:12218-1 No score
php8-8.1.8-1.1 on GA media
These are all security issues fixed in the php8-8.1.8-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:12218-1- Updated
- 2026-11-02
OSVUSN-5530-1 No score
php8.1 vulnerability
It was discovered that PHP incorrectly handled certain memory operations when obtaining file information. A remote attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute arbitrary code.
- Record
USN-5530-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
libphpBitnami |
8.1.0 up to 8.1.8 | 8.1.8 |
phpBitnami |
8.1.0 up to 8.1.8 | 8.1.8 |
php-minBitnami |
8.1.0 up to 8.1.8 | 8.1.8 |
php8.1Ubuntu:22.04:LTS |
before 8.1.2-1ubuntu2.2, plus listed versions 8.1.0~rc4-1ubuntu28.1.0-18.1.2-1ubuntu18.1.2-1ubuntu28.1.2-1ubuntu2.1 |
8.1.2-1ubuntu2.2 |
php8openSUSE:Tumbleweed |
before 8.1.8-1.1 | 8.1.8-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2022-31627 is a high vulnerability (CVSS 7.7) in Php, published July 15, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.14%, the 82nd percentile. Fixed in libphp 8.1.8.