CVE-2012-2376: Buffer overflow in the com_print_typeinfo function in PHP 5.4.3 and earlier on Windows allows remote attack...

Security readout for executives and security teams

This vulnerability affects old Windows deployments of PHP 5.4.3 and earlier. A malformed request path involving PHP COM type handling could overflow memory and allow remote code execution. The source bundle says it was exploited in the wild in May 2012, so any still-running affected host should be treated as legacy high risk. Exposure is most likely on Windows servers running PHP 5.4.3 or earlier, especially applications using PHP COM functionality. Modern supported PHP deployments are not identified as affected in the supplied bundle. Treat this as urgent only if legacy Windows PHP remains in production. The vulnerability is old, but remote code execution plus reported exploitation means lingering affected systems carry disproportionate business risk. Mitigation focus: Inventory Windows servers for PHP 5.4.3 or earlier.; Check PHP/vendor guidance for the fixed or supported replacement version.; Upgrade or replace unsupported affected PHP installations..

Prepared

Jun 24, 2026, 12:52 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.