#RCE

1 article filed under this tag

PHP Extension Heap Overflow Explained: When Metadata Owns the Allocator
August 8, 2026 • 6 min read • 🌐 AR / EN • 🎧 Audio
A custom PHP extension that parses image metadata with a fixed-size buffer and classic strcpy can hand the entire process to an attacker. Pair it with a loose file reader and you get ASLR bypass plus reliable RCE.
#Heap Overflow #PHP Extensions #Zend Allocator #LFI #RCE #Memory Corruption

PHP Extension Heap Overflow Explained: When Metadata Owns the Allocator