{"id":"CVE-2026-128014","aliases":[],"cve":{"records":[{"id":"CVE-2026-128014","source":"VulnCheck","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-11-12T20:32:53.531Z","published":"2026-11-13T09:34:12.011Z","modified":"2026-11-13T09:34:12.011Z"}],"publishers":[{"name":"VulnCheck","role":"CNA","organizationId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","modified":"2026-11-13T09:34:12.011Z"}],"references":[{"url":"https://github.com/php/frankenphp/security/advisories/GHSA-p746-jj3f-94p8","tags":["vendor-advisory"],"source":"VulnCheck"},{"url":"https://www.vulncheck.com/advisories/frankenphp-1.8.0-before-1.13.2-out-of-bounds-write-via-bundled-brotli-decoder","tags":["third-party-advisory"],"source":"VulnCheck"}],"weaknesses":[{"id":"CWE-787","description":"Out-of-bounds Write","source":"VulnCheck"}],"applicability":[{"source":"VulnCheck","statements":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:php:frankenphp:*:*:*:*:*:*:*:*","versionStartIncluding":"1.8.0","versionEndExcluding":"1.13.2"}]}]}]}],"prioritization":[]},"title":"FrankenPHP 1.8.0 before 1.13.2 Out-of-Bounds Write via Bundled Brotli Decoder","titleSource":"VulnCheck","descriptionSource":"VulnCheck","description":"FrankenPHP standalone static binaries 1.8.0 before 1.13.2 bundle the PHP brotli extension statically linked with Brotli 1.2.0, whose decoder contains an out-of-bounds write (CVE-2026-111497). Unauthenticated remote attackers can send crafted data to applications that pass it to brotli_uncompress_add() to crash the entire FrankenPHP process, and possibly cause memory disclosure or code execution.","score":9.2,"severity":"critical","published":"2026-11-13T09:34:12.011Z","modified":"2026-11-13T09:34:12.011Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"php","name":"frankenphp","platforms":[],"versions":[{"version":"1.8.0","status":"affected","lessThan":"1.13.2","versionType":"semver"},{"version":"1.13.2","status":"unaffected","versionType":"semver"}],"defaultStatus":"unaffected","packageURL":"pkg:golang/github.com/dunglas/frankenphp","packageIdentity":{"ecosystem":"Go","name":"github.com/dunglas/frankenphp"},"cpes":[],"source":"VulnCheck","url":"https://www.cve.org/CVERecord?id=CVE-2026-128014"}],"remediation":[],"references":["https://github.com/php/frankenphp/security/advisories/GHSA-p746-jj3f-94p8","https://www.vulncheck.com/advisories/frankenphp-1.8.0-before-1.13.2-out-of-bounds-write-via-bundled-brotli-decoder"],"sources":[{"name":"CVE","id":"CVE-2026-128014","modified":"2026-11-13T09:34:12.011Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-128014"}],"assessments":[{"source":"VulnCheck","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","score":9.2},{"source":"VulnCheck","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","score":8.1}],"sourceAffected":[],"observedAt":"2026-11-13T12:49:35.440Z","kev":{"status":"not-listed","checkedAt":"2026-11-15T01:00:31.976Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-11-14T08:40:32.308Z","attemptedAt":"2026-11-14T08:40:32.308Z"},{"source":"GHSA","status":"available","checkedAt":"2026-11-14T08:30:33.526Z","attemptedAt":"2026-11-14T08:30:33.526Z"},{"source":"EUVD","status":"available","checkedAt":"2026-11-14T08:20:33.671Z","attemptedAt":"2026-11-14T08:20:33.671Z"},{"source":"EPSS","status":"available","checkedAt":"2026-11-14T08:20:33.370Z","attemptedAt":"2026-11-14T08:20:33.370Z"}],"evidence":[{"source":"FIRST EPSS","id":"CVE-2026-128014","url":"https://www.first.org/epss/","probability":0.00746,"percentile":0.55383,"date":"2026-11-13","checkedAt":"2026-11-14T08:20:33.370Z"},{"source":"ENISA EUVD","id":"EUVD-2026-125088","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-125088","modified":"Nov 13, 2026, 9:34:12 AM","score":9.2,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","checkedAt":"2026-11-14T08:20:33.671Z"},{"source":"GitHub Advisory Database","id":"GHSA-g5qv-p6x9-9wpv","url":"https://github.com/advisories/GHSA-g5qv-p6x9-9wpv","modified":"2026-11-13T12:31:36Z","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","checkedAt":"2026-11-14T08:30:33.526Z"},{"source":"NVD","id":"CVE-2026-128014","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-128014","modified":"2026-11-13T10:18:06.583","score":9.2,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","checkedAt":"2026-11-14T08:40:32.308Z"},{"source":"NVD","id":"CVE-2026-128014","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-128014","modified":"2026-11-13T10:18:06.583","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","checkedAt":"2026-11-14T08:40:32.308Z"}],"aiSummary":{"text":"FrankenPHP 1.8.0 before 1.13.2 has an out-of-bounds write weakness via the bundled Brotli decoder, potentially allowing unauthenticated remote attackers to crash the process or disclose memory. The affected versions are 1.8.0 to less than 1.13.2. The impact may include memory disclosure or code execution.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-11-13T13:56:13.242Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-128014"}]}}