CVE-2011-1148: Use-after-free vulnerability in the substr_replace function in PHP 5.3.6 and earlier allows context-depende...

Security readout for executives and security teams

CVE-2011-1148 is an old PHP memory-safety flaw. In PHP 5.3.6 and earlier, certain use of substr_replace could corrupt memory, causing a crash and possibly other unspecified impact. The main business issue is legacy PHP exposure, especially where untrusted input can reach vulnerable application code. Exposure is most likely in legacy systems still running PHP 5.3.6 or earlier, including downstream vendor builds referenced by Apple, Red Hat, Mandriva, and HP advisories. Modern supported PHP deployments are unlikely to be affected, but asset evidence is required. Prioritize as legacy technical debt with availability and possible memory-corruption risk. Escalate if PHP 5.3.6 or earlier is found on internet-facing systems. Without evidence of current exposure, this is not an emergency-level vulnerability from the supplied sources. Mitigation focus: Inventory PHP runtimes and identify versions 5.3.6 or earlier.; Upgrade affected PHP deployments to a supported, vendor-fixed version.; Apply relevant vendor advisories for packaged PHP distributions..

Prepared

Jun 24, 2026, 13:28 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.