---
id: CVE-2019-11050
title: 'When PHP EXIF extension is parsing EXIF information from an image, e.g'
summary: >-
  When PHP EXIF extension is parsing EXIF information from an image, e.g. via
  exif_read_data() function, in PHP versions 7.2.x below 7.2.26, 7.3.x below
  7.3.13 and 7.4.0 it is possible to supply it with data what will cause it to
  read past…
severity: medium
cvss: 4.8
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L'
cwe:
  - CWE-125
  - CWE-125
vendor: php
product: php
affected:
  - 'php >= 7.2.0, <= 7.2.26'
  - 'php >= 7.3.0, <= 7.3.13'
  - php = 7.4.0
  - ubuntu_linux = 12.04
  - ubuntu_linux = 14.04
  - ubuntu_linux = 16.04
  - ubuntu_linux = 18.04
  - ubuntu_linux = 19.04
  - debian_linux = 8.0
  - fedora = 30
  - fedora = 31
  - debian_linux = 9.0
  - debian_linux = 10.0
  - security_center < 5.19.0
  - leap = 15.1
patched:
  - security_center 5.19.0
published: '2019-12-23'
updated: '2026-08-17'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2019-11050'
references:
  - url: 'http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00036.html'
    label: security@php.net
  - url: 'https://bugs.php.net/bug.php?id=78793'
    label: security@php.net
  - url: 'https://lists.debian.org/debian-lts-announce/2019/12/msg00034.html'
    label: security@php.net
  - url: >-
      https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/N7GCOAE6KVHYJ3UQ4KLPLTGSLX6IRVRN/
    label: security@php.net
  - url: >-
      https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XWRQPYXVG43Q7DXMXH6UVWMKWGUW552F/
    label: security@php.net
  - url: 'https://seclists.org/bugtraq/2020/Feb/27'
    label: security@php.net
  - url: 'https://seclists.org/bugtraq/2020/Feb/31'
    label: security@php.net
  - url: 'https://seclists.org/bugtraq/2021/Jan/3'
    label: security@php.net
  - url: 'https://security.netapp.com/advisory/ntap-20200103-0002/'
    label: security@php.net
  - url: 'https://usn.ubuntu.com/4239-1/'
    label: security@php.net
  - url: 'https://www.debian.org/security/2020/dsa-4626'
    label: security@php.net
  - url: 'https://www.debian.org/security/2020/dsa-4628'
    label: security@php.net
  - url: 'https://www.tenable.com/security/tns-2021-14'
    label: security@php.net
  - url: 'http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00036.html'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://bugs.php.net/bug.php?id=78793'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://lists.debian.org/debian-lts-announce/2019/12/msg00034.html'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: >-
      https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/N7GCOAE6KVHYJ3UQ4KLPLTGSLX6IRVRN/
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: >-
      https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XWRQPYXVG43Q7DXMXH6UVWMKWGUW552F/
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://seclists.org/bugtraq/2020/Feb/27'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://seclists.org/bugtraq/2020/Feb/31'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://seclists.org/bugtraq/2021/Jan/3'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://security.netapp.com/advisory/ntap-20200103-0002/'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://usn.ubuntu.com/4239-1/'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://www.debian.org/security/2020/dsa-4626'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://www.debian.org/security/2020/dsa-4628'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://www.tenable.com/security/tns-2021-14'
    label: af854a3a-2127-422b-91ae-364da2661108
tags:
  - nvd
epss: 0.07624
epssPercentile: 0.9429
ingestedAt: '2026-08-17T14:55:58.969Z'
---

## Overview

When PHP EXIF extension is parsing EXIF information from an image, e.g. via exif_read_data() function, in PHP versions 7.2.x below 7.2.26, 7.3.x below 7.3.13 and 7.4.0 it is possible to supply it with data what will cause it to read past the allocated buffer. This may lead to information disclosure or crash.

## Affected

- `php >= 7.2.0, <= 7.2.26`
- `php >= 7.3.0, <= 7.3.13`
- `php = 7.4.0`
- `ubuntu_linux = 12.04`
- `ubuntu_linux = 14.04`
- `ubuntu_linux = 16.04`
- `ubuntu_linux = 18.04`
- `ubuntu_linux = 19.04`
- `debian_linux = 8.0`
- `fedora = 30`
- `fedora = 31`
- `debian_linux = 9.0`
- `debian_linux = 10.0`
- `security_center < 5.19.0`
- `leap = 15.1`

## Remediation

Upgrade past the affected range:

- `security_center 5.19.0`