CVE-2019-11036: Heap over-read in PHP EXIF extension

Security readout for executives and security teams

CVE-2019-11036 is a PHP EXIF parsing flaw. A crafted file processed by vulnerable PHP versions could make PHP read beyond an allocated memory buffer, potentially leaking limited information or crashing the process. Business urgency is moderate where legacy PHP handles untrusted uploads or image metadata. Likely exposure is PHP applications or backend jobs using the EXIF extension to process attacker-supplied files, especially upload, media library, CMS, or image metadata workflows. Systems without the EXIF extension, without affected PHP versions, or without untrusted file processing have lower exposure. Prioritize remediation for internet-facing upload and media-processing systems running legacy PHP. The expected impact is limited information disclosure or service crash, but exposure can be broad in CMS and file-upload workflows. Patch during the next normal security maintenance window unless uploads are critical or unauthenticated. Mitigation focus: Upgrade PHP beyond 7.1.29, 7.2.18, or 7.3.5 as applicable.; Apply fixed distribution packages from Ubuntu, Fedora, Debian, Red Hat, openSUSE, or vendor guidance.; Check whether PHP EXIF processing is required; disable it where unnecessary..

Prepared

Jun 1, 2026, 12:34 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.