CVE-2011-0420: The grapheme_extract function in the Internationalization extension (Intl) for ICU for PHP 5.3.5 allows con...

Security readout for executives and security teams

CVE-2011-0420 is a crash flaw in PHP 5.3.5's Intl grapheme_extract function. If an application passes an invalid size value into this function, PHP can dereference NULL and crash. The business impact is availability loss for affected legacy PHP services, not data theft based on the provided sources. Exposure is most likely in legacy PHP 5.3.5 deployments with the Intl extension enabled and application code that reaches grapheme_extract with attacker-influenced size arguments. The provided affected-product metadata is incomplete, so inventory should verify actual PHP and package versions. Prioritize if any internet-facing or business-critical service still runs PHP 5.3.5 with Intl. For modern PHP estates, urgency is low, but unsupported legacy systems should be retired or patched because a crash can still disrupt service. Mitigation focus: Identify any PHP 5.3.5 systems with the Intl extension enabled.; Apply relevant vendor updates from PHP, Debian, Apple, or your OS distributor.; Upgrade unsupported PHP runtimes to a supported branch where feasible..

Prepared

Jun 27, 2026, 18:32 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.