CVE-2017-12933

What it actually does

The finish_nested_data function performs a buffer over-read during deserialization of attacker-controlled input, allowing out-of-bounds memory access that can corrupt process integrity.

Why it matters to the business

Attackers may be able to alter application behavior or data without authentication, leading to service disruption or unauthorized changes across any systems running the affected PHP versions.

How an attack unfolds

An attacker crafts a malicious serialized payload and supplies it to any PHP application that calls unserialize on untrusted data; the vulnerable deserializer reads past allocated buffers, enabling integrity violations.

How to fix it

Upgrade PHP to version 5.6.31 or later, 7.0.21 or later, or 7.1.7 or later; disable unserialize on untrusted data where possible and replace with safe alternatives such as JSON.

How to confirm the fix worked

Confirm the installed PHP version is at or above the fixed releases; test that crafted serialized payloads no longer trigger crashes or unexpected behavior.

Typical attack path

1. Identify an entry point that accepts serialized input (e.g., cookie, POST body, or cache entry)
2. Generate a specially formed serialized string that triggers nested data structures
3. Submit the payload to the unserialize call
4. Observe or leverage resulting memory state changes to affect application integrity

How to detect it

Review web server and application logs for unusually large or malformed serialized strings; look for segmentation faults or abnormal process terminations in PHP workers after receiving untrusted input.

What your security team should do

• Prioritize patching PHP installations that accept user-supplied serialized data
• Review application code for direct or indirect calls to unserialize on external input
• Implement input validation or switch to JSON encoding for all serialization needs
• Monitor vulnerability feeds for any future exploitation reports despite current low EPSS