high 7.4

CVE-2020-7065 json

mb_strtolower (UTF-32LE): stack-buffer-overflow at php_unicode_tolower_full

published 2020-04-01 6y ago modified 2026-09-08 2mo ago also BIT-libphp-2020-7065 , BIT-php-2020-7065 , BIT-php-min-2020-7065 , EUVD-2020-28199

cvss: 7.4; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 4.9%; EPSS 4.9% chance of exploitation in 30 days, percentile 92%
public exploits: 0; none known

In PHP versions 7.3.x below 7.3.16 and 7.4.x below 7.4.4, while using mb_strtolower() function with UTF-32LE encoding, certain invalid strings could cause PHP to overwrite stack-allocated buffer. This could lead to memory corruption, crashes and potentially code execution.

Patch / fix

fixed in 4 distros 6 links 2

bitnami libphp 7.3.16, 7.4.4
bitnami php 7.3.16, 7.4.4
bitnami php-min 7.3.16, 7.4.4
PHP Group PHP 7.3.16, 7.4.4

debian ubuntu red hat almalinux rocky linux alpine

php7.4 Debian 11 7.4.5-1

debian advisories DEBIAN-CVE-2020-7065

php7.4 Ubuntu 20.04 LTS 7.4.3-4ubuntu1.1

ubuntu advisories UBUNTU-CVE-2020-7065

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

php RHEL 8 7.3.20-1.module+el8.2.0+7373+b272fdef
libzip RHEL 8 1.5.2-1.module+el8.1.0+3189+a1bff096
php-gd RHEL 8 7.3.20-1.module+el8.2.0+7373+b272fdef
php-cli RHEL 8 7.3.20-1.module+el8.2.0+7373+b272fdef
php-dba RHEL 8 7.3.20-1.module+el8.2.0+7373+b272fdef
php-dbg RHEL 8 7.3.20-1.module+el8.2.0+7373+b272fdef
php-fpm RHEL 8 7.3.20-1.module+el8.2.0+7373+b272fdef
php-gmp RHEL 8 7.3.20-1.module+el8.2.0+7373+b272fdef

red hat advisories RHSA-2020:3662 RHSA-2020:5275

php AlmaLinux 8 7.3.20-1.module_el8.4.0+2229+b272fdef
php AlmaLinux 8 7.3.20-1.module_el8.5.0+152+112d3b8c
php AlmaLinux 8 7.3.20-1.module_el8.3.0+2009+b272fdef
libzip AlmaLinux 8 1.5.2-1.module_el8.5.0+152+112d3b8c
libzip AlmaLinux 8 1.5.2-1.module_el8.3.0+2009+b272fdef
libzip AlmaLinux 8 1.5.2-1.module_el8.4.0+2229+b272fdef
php-gd AlmaLinux 8 7.3.20-1.module_el8.4.0+2229+b272fdef
php-gd AlmaLinux 8 7.3.20-1.module_el8.3.0+2009+b272fdef

almalinux advisories ALSA-2020:3662

php Rocky Linux 8 7.3.20-1.module+el8.4.0+414+2e7afcdd
libzip Rocky Linux 8 1.5.2-1.module+el8.4.0+414+2e7afcdd
php-pear Rocky Linux 8 1:1.10.9-1.module+el8.4.0+414+2e7afcdd
php-pecl-rrd Rocky Linux 8 2.0.1-1.module+el8.4.0+414+2e7afcdd
php-pecl-zip Rocky Linux 8 1.15.4-1.module+el8.4.0+414+2e7afcdd
php-pecl-apcu Rocky Linux 8 5.1.17-1.module+el8.4.0+414+2e7afcdd
php-pecl-xdebug Rocky Linux 8 2.8.0-1.module+el8.4.0+414+2e7afcdd

rocky linux advisories RLSA-2020:3662

php7 Alpine 3.15, Alpine 3.14, Alpine 3.13 +2 more 7.3.16-r0

alpine advisories ALPINE-CVE-2020-7065

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

oracle.com/security-alerts/cpuoct2021.html advisory
bugs.php.net/bug.php?id=79371 advisory

Is CVE-2020-7065 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2020-7065 updated 2026-11-05 cvss 8.8

php: Using mb_strtolower() function with UTF-32LE encoding leads to potential code execution

Red Hat Enterprise Linux AppStream (v. 8) php 7.3.20-1.module+el8.2.0+7373+b272fdef, libzip 1.5.2-1.module+el8.1.0+3189+a1bff096, php-gd 7.3.20-1.module+el8.2.0+7373+b272fdef, php-cli 7.3.20-1.module+el8.2.0+7373+b272fdef, php-dba 7.3.20-1.module+el8.2.0+7373+b272fdef, php-dbg 7.3.20-1.module+el8.2.0+7373+b272fdef, +28 more
fixed: vendor fix RHSA-2020:3662
Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) rh-php73-php 7.3.20-1.el7, rh-php73-php-gd 7.3.20-1.el7, rh-php73-php-cli 7.3.20-1.el7, rh-php73-php-dba 7.3.20-1.el7, rh-php73-php-dbg 7.3.20-1.el7, rh-php73-php-fpm 7.3.20-1.el7, +22 more Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6) rh-php73-php 7.3.20-1.el7, rh-php73-php-gd 7.3.20-1.el7, rh-php73-php-cli 7.3.20-1.el7, rh-php73-php-dba 7.3.20-1.el7, rh-php73-php-dbg 7.3.20-1.el7, rh-php73-php-fpm 7.3.20-1.el7, +22 more Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7) rh-php73-php 7.3.20-1.el7, rh-php73-php-gd 7.3.20-1.el7, rh-php73-php-cli 7.3.20-1.el7, rh-php73-php-dba 7.3.20-1.el7, rh-php73-php-dbg 7.3.20-1.el7, rh-php73-php-fpm 7.3.20-1.el7, +22 more Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) rh-php73-php 7.3.20-1.el7, rh-php73-php-gd 7.3.20-1.el7, rh-php73-php-cli 7.3.20-1.el7, rh-php73-php-dba 7.3.20-1.el7, rh-php73-php-dbg 7.3.20-1.el7, rh-php73-php-fpm 7.3.20-1.el7, +22 more
fixed: vendor fix RHSA-2020:5275
Red Hat Enterprise Linux 5 php, php53 Red Hat Enterprise Linux 6 php, php-gd, php-cli, php-dba, php-fpm, php-pdo, +20 more Red Hat Enterprise Linux 7 php, php-gd, php-cli, php-dba, php-fpm, php-pdo, +18 more Red Hat Enterprise Linux 8 php, libzip, php-gd, php-cli, php-dba, php-dbg, +30 more Red Hat Software Collections rh-php72-php, rh-php72-php-gd, rh-php72-php-cli, rh-php72-php-dba, rh-php72-php-dbg, rh-php72-php-fpm, +22 more
not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

cisa ICSA-26-027-02 updated 2026-01-27 cvss 8.8

Festo Didactic SE MES PC

Festo Didactic SE MES PC shipped_with_Windows_10
affected: vendor fix

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

Exploit prediction

4.87% chance of exploitation in the next 30 days, higher than 92% of all scored CVEs (FIRST EPSS, 2026-11-09).

Exploits and checks

bugs.php.net https://bugs.php.net/bug.php?id=79371 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
CNA	3.1	7.4	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H
NVD	3.1	8.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
NVD	2.0	6.8	AV:N/AC:M/Au:N/C:P/I:P/A:P
OSV	3.1	8.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected packages

ecosystem	package	affected	fixed in
bitnami	libphp	>=7.3.0, <7.3.16 >=7.4.0, <7.4.4	7.3.16 7.4.4
bitnami	php	>=7.3.0, <7.3.16 >=7.4.0, <7.4.4	7.3.16 7.4.4
bitnami	php-min	>=7.3.0, <7.3.16 >=7.4.0, <7.4.4	7.3.16 7.4.4

Affected products

PHP Group PHP

Classification

Weakness

CWE-121 Stack-based Buffer Overflow
CWE-787 Out-of-bounds Write

Technology feeds

PHP rss critical rss

References

oracle.com /security-alerts/cpuoct2021.html
patch, third-party-advisory, advisory
bugs.php.net /bug.php?id=79371
exploit, issue-tracking, patch, vendor-advisory, advisory
usn.ubuntu.com /4330-1/
vendor-advisory, third-party-advisory, advisory
usn.ubuntu.com /4330-2/
vendor-advisory, third-party-advisory, advisory
debian.org /security/2020/dsa-4719
vendor-advisory, third-party-advisory, advisory
php.net /ChangeLog-7.php#7.4.4
release-notes, vendor-advisory, advisory
security.netapp.com /advisory/ntap-20200403-0001/
third-party-advisory, advisory
tenable.com /security/tns-2021-14
third-party-advisory, advisory
nvd.nist.gov /vuln/detail/CVE-2020-7065
web

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

json all entries feed