CVE-2024-11236

What it actually does

Uncontrolled long string inputs to ldap_escape() on 32-bit systems trigger an integer overflow that results in an out-of-bounds write.

Why it matters to the business

Attackers can achieve remote code execution on affected 32-bit PHP deployments, leading to full system compromise, data theft, or service disruption; the high CVSS and public disclosure increase urgency for organizations still running older 8.1/8.2/8.3 releases.

How an attack unfolds

An attacker supplies an excessively long string to any code path that calls ldap_escape() with attacker-controlled data; on 32-bit builds the integer overflow occurs during length calculations, allowing the subsequent write to corrupt adjacent memory and potentially hijack control flow.

How to fix it

Upgrade PHP to 8.1.31 or later, 8.2.26 or later, or 8.3.14 or later; apply the exact commits or packages listed for php/php-src (38123aca18c3c1bd1f109ec77af2f175d7afcf35) and any downstream distributions; disable 32-bit builds where possible or isolate affected services until patched.

How to confirm the fix worked

Verify running PHP version with 'php -v' or phpinfo(); confirm the patch commit is present in source; test that ldap_escape() no longer accepts inputs that previously caused overflow on 32-bit systems; re-scan with vulnerability assessment tools after upgrade.

Typical attack path

1. Identify a web application or script that passes unsanitized input into ldap_escape() on a 32-bit PHP installation
2. Craft a payload containing a string long enough to trigger the 32-bit integer overflow
3. Send the payload via HTTP, CLI, or other entry point that reaches the vulnerable call
4. Achieve out-of-bounds write and gain arbitrary code execution or crash the process

How to detect it

Search web server and application logs for unusually long strings passed to LDAP-related functions; monitor for segmentation faults or crashes in PHP processes handling LDAP escape operations; inspect core dumps or memory logs for signs of out-of-bounds writes around ldap_escape calls.

What your security team should do

• Immediately inventory all 32-bit PHP 8.1/8.2/8.3 installations and prioritize upgrade to the fixed releases
• Apply patches within the next 48 hours given the critical CVSS and public exploitability
• Review application code for direct or indirect calls to ldap_escape() with untrusted input
• Consider disabling LDAP functionality or moving to 64-bit deployments if upgrades cannot be completed quickly