CVE-2010-4156

CVE-2010-4156 is a medium-severity vulnerability in Scottmac Libmbfl with a CVSS 2.0 base score of 5.0. Its EPSS exploit-prediction score of 13% places it in the 96th percentile, indicating an elevated likelihood of exploitation. The underlying weakness is classified as CWE-20.

Key facts

Description

The mb_strcut function in Libmbfl 1.1.0, as used in PHP 5.3.x through 5.3.3, allows context-dependent attackers to obtain potentially sensitive information via a large value of the third parameter (aka the length parameter).

Frequently asked questions

What is CVE-2010-4156?
The mb_strcut function in Libmbfl 1.1.0, as used in PHP 5.3.x through 5.3.3, allows context-dependent attackers to obtain potentially sensitive information via a large value of the third parameter (aka the length parameter).
How severe is CVE-2010-4156?
CVE-2010-4156 has a CVSS 2.0 base score of 5.0, rated medium severity.
Is CVE-2010-4156 being actively exploited?
It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 13% (96th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2010-4156?
CVE-2010-4156 affects Scottmac Libmbfl. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2010-4156?
Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
When was CVE-2010-4156 published?
CVE-2010-4156 was published on 2010-11-10 and last updated on 2026-06-16.

References

Affected products (1)

Other CWE-20 (Improper Input Validation) vulnerabilities

Browse all CWE-20 (Improper Input Validation) vulnerabilities →

Threat intelligence

Threat-intel indicators referencing this CVE: