CVE-2024-8932 OOB access in ldap_escape
An integer overflow in PHP's ldap_escape function on 32-bit systems allows out-of-bounds writes, potentially enabling code execution.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-8932?
CVE-2024-8932 is a critical vulnerability in Php Php, published on 22 Nov 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In PHP versions 8.1.* before 8.1.31, 8.2.* before 8.2.26, 8.3.* before 8.3.14, uncontrolled long string inputs to ldap_escape() function on 32-bit systems can cause an integer overflow, resulting in an out-of-bounds write.
Weakness: CWE-787
Which versions are affected by CVE-2024-8932?
3 open source packages ship an affected version, including libphp, php and php-min. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
libphp Bitnami | All versions | 8.1.31, 8.2.26, 8.3.14 |
php Bitnami | All versions | 8.1.31, 8.2.26, 8.3.14 |
php-min Bitnami | All versions | 8.1.31, 8.2.26, 8.3.14 |
Products include Netapp Ontap, Php Php.
How do I fix CVE-2024-8932?
Upgrade libphp to a fixed version for your release line: 8.1.31, 8.2.26 or 8.3.14.
Is CVE-2024-8932 being exploited?
There is no known exploitation of CVE-2024-8932 in the wild and no public exploit code.
Other vulnerabilities in Php Php
- CVE-2026-22049 Auth bypass in ONTAP 9
- CVE-2026-22050 Business logic in ONTAP 9
- CVE-2025-1734 Streams HTTP wrapper does not fail for headers with invalid name and no colon
- CVE-2025-1736 Stream HTTP wrapper header check might omit basic auth header
- CVE-2025-1861 Stream HTTP wrapper truncates redirect location to 1024 bytes
Sources
Also known as AZL-53480, AZL-53748, BELL-CVE-2024-8932, BIT-libphp-2024-8932, BIT-php-2024-8932, BIT-php-min-2024-8932 and 9 more.