Heap Overflow Vulnerability in HHVM from Incorrect String Size Calculations

CVE-2021-24025

What is CVE-2021-24025?

A vulnerability exists in HHVM caused by incorrect string size calculations within the preg_quote function. This flaw allows a large input string to trigger an integer overflow, potentially resulting in a heap overflow. This could lead to unintended behavior or exploitation in affected versions of the HHVM engine, posing security risks for applications relying on this technology.

References