How severe is CVE-2019-3557?

CVE-2019-3557 has a CVSS 3.x base score of 9.8, rated critical severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.

Is CVE-2019-3557 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 2% (75th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2019-3557?

CVE-2019-3557 affects Facebook Hhvm. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2019-3557?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.

When was CVE-2019-3557 published?

CVE-2019-3557 was published on 2019-01-15 and last updated on 2026-06-17.

CVE-2019-3557

CVE-2019-3557 is a critical-severity vulnerability in Facebook Hhvm with a CVSS 3.x base score of 9.8. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-125.

Key facts

Severity: Critical (CVSS 3.x base score 9.8)
CVSS v2: 7.5
EPSS exploit prediction: 2% (75th percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-125
Affected product: Facebook Hhvm
Published: 2019-01-15
Last modified: 2026-06-17

Description

The implementations of streams for bz2 and php://output improperly implemented their readImpl functions, returning -1 consistently. This behavior caused some stream functions, such as stream_get_line, to trigger an out-of-bounds read when operating on such malformed streams. The implementations were updated to return valid values consistently. This affects all supported versions of HHVM (3.30 and 3.27.4 and below).

Frequently asked questions

What is CVE-2019-3557?: The implementations of streams for bz2 and php://output improperly implemented their readImpl functions, returning -1 consistently. This behavior caused some stream functions, such as stream_get_line, to trigger an out-of-bounds read when operating on such malformed streams. The implementations were updated to return valid values consistently. This affects all supported versions of HHVM (3.30 and 3.27.4 and below).
How severe is CVE-2019-3557?: CVE-2019-3557 has a CVSS 3.x base score of 9.8, rated critical severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.
Is CVE-2019-3557 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 2% (75th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2019-3557?: CVE-2019-3557 affects Facebook Hhvm. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2019-3557?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.
When was CVE-2019-3557 published?: CVE-2019-3557 was published on 2019-01-15 and last updated on 2026-06-17.

References

Affected products (1)

cpe:2.3:a:facebook:hhvm:*:*:*:*:*:*:*:*

More vulnerabilities in Facebook Hhvm

CVE-2022-36937 — Critical (CVSS 9.8): HHVM 4.172.0 and all prior versions use TLS 1.0 for secure connections when handling tls:// URLs in the stream…
CVE-2021-24036 — Critical (CVSS 9.8): Passing an attacker controlled size when creating an IOBuf could cause integer overflow, leading to an out of bounds…
CVE-2020-1900 — Critical (CVSS 9.8): When unserializing an object with dynamic properties HHVM needs to pre-reserve the full size of the dynamic property…
CVE-2021-24025 — Critical (CVSS 9.8): Due to incorrect string size calculations inside the preg_quote function, a large input string passed to the function…
CVE-2020-1917 — Critical (CVSS 9.8): xbuf_format_converter, used as part of exif_read_data, was appending a terminating null character to the generated…
CVE-2020-1916 — Critical (CVSS 9.8): An incorrect size calculation in ldap_escape may lead to an integer overflow when overly long input is passed in,…

All CVEs affecting Facebook Hhvm →

Other CWE-125 (Out-of-bounds Read) vulnerabilities

CVE-2026-24826 — Critical (CVSS 10.0): Out-of-bounds Write, Divide By Zero, NULL Pointer Dereference, Use of Uninitialized Resource, Out-of-bounds Read,…
CVE-2024-22004 — Critical (CVSS 10.0): Due to length check, an attacker with privilege access on a Linux Nonsecure operating system can trigger a…
CVE-2021-41556 — Critical (CVSS 10.0): sqclass.cpp in Squirrel through 2.2.5 and 3.x through 3.1 allows an out-of-bounds read (in the core interpreter) that…
CVE-2021-21777 — Critical (CVSS 10.0): An information disclosure vulnerability exists in the Ethernet/IP UDP handler functionality of EIP Stack Group OpENer…
CVE-2017-14451 — Critical (CVSS 10.0): An exploitable out-of-bounds read vulnerability exists in libevm (Ethereum Virtual Machine) of CPP-Ethereum. A…
CVE-2013-0767 — Critical (CVSS 10.0): The nsSVGPathElement::GetPathLengthScale function in Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and…

Browse all CWE-125 (Out-of-bounds Read) vulnerabilities →