CVE-2011-1092: Integer overflow in ext/shmop/shmop.c in PHP before 5.3.6 allows context-dependent attackers to cause a den...

Security readout for executives and security teams

CVE-2011-1092 is an old PHP flaw in the shared-memory extension. A crafted use of shmop_read with an extremely large size value can crash PHP and may expose memory. The main business concern is availability, with possible confidentiality impact where legacy PHP before 5.3.6 is still running. Exposure is most likely in legacy PHP deployments that enable or use the shmop extension and remain below PHP 5.3.6 or vendor builds without the fix. Treat this as a legacy-risk cleanup item unless affected PHP systems are internet-facing or process untrusted inputs. The age of the CVE lowers urgency for modern stacks, but unfixed legacy PHP can still create outage and data-exposure risk. Mitigation focus: Identify PHP runtimes older than 5.3.6.; Upgrade to PHP 5.3.6 or a vendor package containing the fix.; Disable shmop where it is not required..

Prepared

Jun 24, 2026, 13:28 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.