CVE-2024-11233

Single byte overread with convert.quoted-printable-decode filter

In PHP versions 8.1.* before 8.1.31, 8.2.* before 8.2.26, 8.3.* before 8.3.14, due to an error in convert.quoted-printable-decode filter certain data can lead to buffer overread by one byte, which can in certain circumstances lead to crashes or disclose content of other memory areas.

We have discovered 218,948 live websites that are affected by CVE-2024-11233.

Run a Free Instant Scan



Affected Software

Product  PHP
Category Programming Languages
Vulnerable Domains218,948 live websites (3.06% of PHP install base)
Vulnerable Versions
  • from 8.1 through 8.1.31
  • from 8.2 through 8.2.26
  • from 8.3 through 8.3.14
Vulnerable Versions Count71 versions ( 14% of all versions)


Common Weakness Enumeration

CWE-122 Heap-based Buffer Overflow



Details

  • Published - Nov 24, 2024
  • Updated - Nov 3, 2025

Credits

  • Frostb1te (reporter)

Website Distribution by Country

Number of websites using CVE-2024-11233
United States33,758 websites


France78,540 websites
Russia14,795 websites
Germany8,586 websites
Netherlands7,647 websites
Brazil7,155 websites
Italy5,838 websites
Poland4,781 websites
Australia4,366 websites
Japan4,197 websites

Website Distribution by TLD

Number of websites using CVE-2024-11233
.com72,645 websites
.fr32,605 websites
.ru12,750 websites
.org8,618 websites
.nl6,828 websites
.net6,522 websites
.com.br5,959 websites
.de4,666 websites
.be4,641 websites
.it4,525 websites

Vulnerable Versions

Vulnerable versions are highlighted in red

Websites affected by CVE-2024-11233

Top websites that are affected by CVE-2024-11233. Please click on the "Contact us" link to get more information.
DomainCountryRankContacts
****************.com United States*,***
********.********.it Italy*,***
*******.com Germany*,***
******.com United States*,***
***********************.com United States*,***
**********.edu United States*,***
***************.org United States*,***
***.de Germany*,***
****.org United States*,***
************.com United States*,***
See full domain list

FAQ

CVE-2024-11233 is Heap-based Buffer Overflow in PHP
A total of 218,948 websites have been identified as vulnerable to CVE-2024-11233, based on global website indexing conducted by WebTechSurvey.
The PHP is affected by the CVE-2024-11233 vulnerability.
PHP versions up to 8.3.14 are vulnerable to CVE-2024-11233.
CVE-2024-11233 is resolved in version 8.3.14 of PHP.