In PHP versions 7.3.x below 7.3.16 and 7.4.x below 7.4.4, while using mb_strtolower() function with UTF-32LE encoding, certain invalid strings could cause PHP to overwrite stack-allocated buffer. This could lead to memory corruption, crashes and potentially code execution.
https://bugs.php.net/bug.php?id=79371
https://security.netapp.com/advisory/ntap-20200403-0001/
https://usn.ubuntu.com/4330-1/
https://usn.ubuntu.com/4330-2/
https://www.debian.org/security/2020/dsa-4719
https://www.php.net/ChangeLog-7.php#7.4.4
Source: MITRE
Published: 2020-04-01
Updated: 2021-12-02
Type: CWE-787
Base Score: 6.8
Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P
Impact Score: 6.4
Exploitability Score: 8.6
Severity: MEDIUM
Base Score: 8.8
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Impact Score: 5.9
Exploitability Score: 2.8
Severity: HIGH