CVE-2024-11235 Reference counting in php_request_shutdown causes Use-After-Free
A use-after-free in PHP's request shutdown allows remote code execution if attackers control memory layout via crafted inputs.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-11235?
CVE-2024-11235 is a critical use after free vulnerability in Php Php, published on 4 Apr 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In PHP versions 8.3.* before 8.3.19 and 8.4.* before 8.4.5, a code sequence involving __set handler or ??= operator and exceptions can lead to a use-after-free vulnerability. If the third party can control the memory layout leading to this, for example by supplying specially crafted inputs to the script, it could lead to remote code execution.
Weakness: CWE-416
Which versions are affected by CVE-2024-11235?
3 open source packages ship an affected version, including libphp, php and php-min. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
libphp Bitnami | From 8.3.0 | 8.3.19, 8.4.5 |
php Bitnami | From 8.3.0 | 8.3.19, 8.4.5 |
php-min Bitnami | From 8.3.0 | 8.3.19, 8.4.5 |
Products include Php Php.
How do I fix CVE-2024-11235?
Upgrade libphp to a fixed version for your release line: 8.3.19 or 8.4.5.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2024-11235 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-11235 exists.
Other vulnerabilities in Php Php
Sources
Also known as BELL-CVE-2024-11235, BIT-libphp-2024-11235, BIT-php-2024-11235, BIT-php-min-2024-11235, CLSA-2025-1744631408, CLSA-2025-1744632037 and 6 more.