CVE-2020-1918

In-memory file operations (ie: using fopen on a data URI) did not properly restrict negative seeking, allowing for the reading of memory prior to the in-memory buffer. This issue affects HHVM versions prior to 4.56.3, all versions between 4.57.0 and 4.80.1, all versions between 4.81.0 and 4.93.1, and versions 4.94.0, 4.95.0, 4.96.0, 4.97.0, 4.98.0.

Scoring

CVSS base score

0.01

EPSS probability

0.33%

CWE

CWE-127

Published

2021-03-10

Last modified

2026-03-14

Affected products

• Facebook HHVM
• Facebook HHVM
• Facebook HHVM
• Facebook HHVM
• Facebook HHVM
• Facebook HHVM
• Facebook HHVM
• Facebook HHVM

Weakness type

• CWE-127

Related vulnerabilities

• CVE-2026-45683 — OpenTelemetry eBPF Instrumentation: Java TLS ioctl kprobe allows kernel memory disclosure
• CVE-2026-5928 — Potential buffer under-read in ungetwc
• CVE-2025-20359 — Multiple Cisco Products Snort 3 MIME Information Disclosure or Denial of Service Vulnerability
• CVE-2025-32050 — Libsoup: integer overflow in append_param_quoted
• CVE-2024-10395 — net: lib: http_server: Buffer Under-read
• CVE-2024-25629 — c-ares out of bounds read in ares__read_line()
• CVE-2020-5360 — Dell BSAFE Micro Edition Suite, versions prior to 4.5, are vulnerable to a Buffer Under-Read...

Markdown version · Browse all CVEs