CVE-2021-24025

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Due to incorrect string size calculations inside the preg_quote function, a large input string passed to the function can trigger an integer overflow leading to a heap overflow. This issue affects HHVM versions prior to 4.56.3, all versions between 4.57.0 and 4.80.1, all versions between 4.81.0 and 4.93.1, and versions 4.94.0, 4.95.0, 4.96.0, 4.97.0, 4.98.0.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-122 CWE-190

Affected software

No affected versions have been published.

Timeline

Published: Mar 10, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-240269.8A missing bounds check within the audio decoding pipeline for WhatsApp calls in WhatsApp for Android prior to v2.21.3, WhatsApp Business for CVE-2021-240277.5A cache configuration issue prior to WhatsApp for Android v2.21.4.18 and WhatsApp Business for Android v2.21.4.18 may have allowed a third p CVE-2021-240289.8An invalid free in Thrift's table-based serialization can cause the application to crash or potentially result in code execution or other un CVE-2021-240297.5A packet of death scenario is possible in mvfst via a specially crafted message during a QUIC session, which causes a crash via a failed ass CVE-2021-24035.3Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are CVE-2021-240309.8The fbgames protocol handler registered as part of Facebook Gameroom does not properly quote arguments passed to the executable. That allows CVE-2021-240315.5In the Zstandard command-line utility prior to v1.4.1, output files were created with default permissions. Correct file permissions (matchin CVE-2021-240324.7Beginning in v1.4.1 and prior to v1.4.9, due to an incomplete fix for CVE-2021-24031, the Zstandard command-line utility created output file CVE-2021-240335.6react-dev-utils prior to v11.0.4 exposes a function, getProcessForPort, where an input argument is concatenated into a command string to be CVE-2021-240359.1A lack of filename validation when unzipping archives prior to WhatsApp for Android v2.21.8.13 and WhatsApp Business for Android v2.21.8.13 CVE-2021-240369.8Passing an attacker controlled size when creating an IOBuf could cause integer overflow, leading to an out of bounds write on the heap with CVE-2021-240379.8A use after free in hermes, while emitting certain error messages, prior to commit d86e185e485b6330216dee8e854455c694e3a36e allows attackers