CVE-2018-6334 Other in HHVM

Critical 9.8 Published 31 Dec 2018 Updated 6 May 2025

Improper variable registration in multipart uploads can lead to unexpected behavior and potential code execution in HHVM.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2018-6334?

CVE-2018-6334 is a critical vulnerability in Facebook HHVM, published on 31 Dec 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Multipart-file uploads call variables to be improperly registered in the global scope. In cases where variables are not declared explicitly before being used this can lead to unexpected behavior. This affects all supported versions of HHVM prior to the patch (3.25.1, 3.24.5, and 3.21.9 and below).

Weakness: CWE-20, CWE-621

Which versions are affected by CVE-2018-6334?

It affects 1 product.

Products include Facebook Hhvm.

How do I fix CVE-2018-6334?

No fix has been published for CVE-2018-6334 yet. Limit exposure of the affected software until one is available.

Is CVE-2018-6334 being exploited?

There is no known exploitation of CVE-2018-6334 in the wild and no public exploit code.

Sources

Also known as GHSA-v7mg-wg5h-pcx8, UBUNTU-CVE-2018-6334.