CVE-2016-10158

What it actually does

The exif_convert_any_to_int function in PHP crashes when processing crafted EXIF data that triggers division of the minimum representable negative integer by -1.

Why it matters to the business

Attackers can remotely crash PHP-based applications or services, causing denial of service and interrupting availability until restart; the issue affects container images used in Kyverno deployments and should be addressed promptly despite low EPSS and no known KEV or ransomware usage.

How an attack unfolds

An attacker crafts an image file containing malicious EXIF metadata and supplies it to any PHP application or service that parses EXIF data; the input reaches exif_convert_any_to_int, triggering the integer division flaw and crashing the process. No named threat actors are associated with exploitation of this CVE.

How to fix it

Upgrade affected Kyverno packages to the fixed versions: kyverno (Chainguard) 1.12.3-r2 and kyverno (Wolfi) 1.12.3-r2; rebuild and redeploy container images containing the updated packages.

How to confirm the fix worked

Confirm the installed package versions match or exceed the fixed releases listed above; test EXIF processing with known trigger images to verify the crash no longer occurs.

Typical attack path

1. Identify a PHP application endpoint that processes image uploads or EXIF metadata
2. Craft an image file with EXIF data designed to trigger the integer overflow condition
3. Deliver the malicious image to the target via upload, URL, or API request
4. Observe application crash and service disruption

How to detect it

Monitor application and PHP error logs for segmentation faults or crashes during image/EXIF processing; look for repeated requests containing image uploads immediately preceding service restarts.

What your security team should do

• Prioritize upgrade of Kyverno images to the patched package versions within the next patch cycle
• Scan container registries and build pipelines for any remaining vulnerable Kyverno images
• Review PHP EXIF handling code paths and consider input sanitization or library restrictions where upgrades are delayed