CVE-2019-11930
An invalid free in mb_detect_order can cause the application to crash or potentially result in...
CVE-2019-11930 is a critical vulnerability (CVSS 9.8) in Facebook Hhvm, published December 4, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.25%, the 88th percentile. No source names a fixed version.
- Severity
- 9.8 CriticalCVSS 3.1, NVD
- Exploit chance
- 3.25%EPSS, 88th percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
- No fix listedNo source names one
Description
An invalid free in mb_detect_order can cause the application to crash or potentially result in remote code execution. This issue affects HHVM versions prior to 3.30.12, all versions between 4.0.0 and 4.8.5, all versions between 4.9.0 and 4.23.1, as well as 4.24.0, 4.25.0, 4.26.0, 4.27.0, 4.28.0, and 4.28.1.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
hhvmUbuntu:16.04:LTS | All versions, plus listed versions 3.11.0+dfsg-13.11.1+dfsg-13.11.1+dfsg-1ubuntu1 | None known |
hhvmUbuntu:18.04:LTS | All versions, plus listed versions 3.21.0+dfsg-23.21.0+dfsg-2build13.21.0+dfsg-2build23.21.0+dfsg-2build33.21.0+dfsg-2ubuntu2 | None known |
What each source reports
NVD Score used
An invalid free in mb_detect_order can cause the application to crash or potentially result in remote code execution. This issue affects HHVM versions prior to 3.30.12, all versions between 4.0.0 and 4.8.5, all versions between 4.9.0 and 4.23.1, as well as 4.24.0, 4.25.0, 4.26.0, 4.27.0, 4.28.0, and 4.28.1.
- Record
CVE-2019-11930- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-763
- Updated
- 2026-11-02
CVE ListNo score
An invalid free in mb_detect_order can cause the application to crash or potentially result in remote code execution. This issue affects HHVM versions prior to 3.30.12, all versions between 4.0.0 and 4.8.5, all versions between 4.9.0 and 4.23.1, as well as 4.24.0, 4.25.0, 4.26.0, 4.27.0, 4.28.0, and 4.28.1.
- Record
CVE-2019-11930- Weakness
- CWE-763
- Updated
- 2026-11-02
EUVDEUVD-2019-3588No score
An invalid free in mb_detect_order can cause the application to crash or potentially result in remote code execution. This issue affects HHVM versions prior to 3.30.12, all versions between 4.0.0 and 4.8.5, all versions between 4.9.0 and 4.23.1, as well as 4.24.0, 4.25.0, 4.26.0, 4.27.0, 4.28.0, and 4.28.1.
- Record
EUVD-2019-3588- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-5h4f-x39p-f6v8
An invalid free in mb_detect_order can cause the application to crash or potentially result in...
An invalid free in mb_detect_order can cause the application to crash or potentially result in remote code execution. This issue affects HHVM versions prior to 3.30.12, all versions between 4.0.0 and 4.8.5, all versions between 4.9.0 and 4.23.1, as well as 4.24.0, 4.25.0, 4.26.0, 4.27.0, 4.28.0, and 4.28.1.
- Record
GHSA-5h4f-x39p-f6v8- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-763
- Updated
- 2026-11-02
OSV
An invalid free in mb_detect_order can cause the application to crash or potentially result in remote code execution. This issue affects HHVM versions prior to 3.30.12, all versions between 4.0.0 and 4.8.5, all versions between 4.9.0 and 4.23.1, as well as 4.24.0, 4.25.0, 4.26.0, 4.27.0, 4.28.0, and 4.28.1.
- Record
CVE-2019-11930- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-04
OSVUBUNTU-CVE-2019-11930
An invalid free in mb_detect_order can cause the application to crash or potentially result in remote code execution. This issue affects HHVM versions prior to 3.30.12, all versions between 4.0.0 and 4.8.5, all versions between 4.9.0 and 4.23.1, as well as 4.24.0, 4.25.0, 4.26.0, 4.27.0, 4.28.0, and 4.28.1.
- Record
UBUNTU-CVE-2019-11930- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | OSV | |
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
github.com/facebook/hhvm/commit/524d2e60cfe910406ec6109e4286d7edd545ab36
hhvm.com/blog/2019/10/28/security-update.html
facebook.com/security/advisories/cve-2019-11930
nvd.nist.gov/vuln/detail/CVE-2019-11930
ubuntu.com/security/CVE-2019-11930
cve.org/CVERecord?id=CVE-2019-11930