CVE-2018-6334: facebook hhvm Variable Extraction Error
CVSS: 9.8v3.1CriticalModified
AliasesUBUNTU-CVE-2018-6334
Published 31-12-2018Last modified 06-05-2025
Vulnerability summary
CVE-2018-6334 is a critical (CVSS 9.8) Variable Extraction Error vulnerability in facebook hhvm. EPSS estimates a 1.91% chance of exploitation in the next 30 days, higher than 79.5% of scored vulnerabilities.
CVSS score
9.8/10
010
Critical · v3.1 (CVE.org)EPSS score
1.91%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Timeline
- 31-12-2018PublishedVulnerability first disclosed.
- 06-05-2025Last modifiedVulnerability information updated.
Description
Multipart-file uploads call variables to be improperly registered in the global scope. In cases where variables are not declared explicitly before being used this can lead to unexpected behavior. This affects all supported versions of HHVM prior to the patch (3.25.1, 3.24.5, and 3.21.9 and below).
CVSS metrics
6 scores · 3 sources · 3 versionsCritical 9.8Preferred score · CVE.org (CNA)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HSourcesAll 3 agree
- NVDNIST9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · UbuntuEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Critical 9.8Preferred score · NVD (NIST)
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HSourcesAll 2 agree
- OSV · UbuntuEcosystem advisory · calculated9.8CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
High 7.5Preferred score · NVD (NIST)
AV:N/AC:L/Au:N/C:P/I:P/A:PSourcesSingle source
EPSS trend
Probability
1.91%
Chance of exploitation in the next 30 days
Percentile
80%
Versus all other CVEs
30-day change
0.00 pp
From 1.91% on 20-09-2026
20-09-202620-10-2026
EPSS score1.91%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-621Variable Extraction ErrorThe product uses external input to determine the names of variables into which information is extracted, without verifying that the names of the specified variables are valid. This could cause the program to overwrite unintended variables.
- CWE-20Improper Input ValidationThe product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
Affected systems
Facebook1 product
- hhvm3.25.2 | 3.25.0 | 3.24.6 | 3.22.0 | 3.21.10 | ≥ unspecified, < 3.21.10 | ≤ 3.21.9 | ≥ 3.21.10, ≤ 3.24.5 | ≥ 3.24.6, ≤ 3.25.1
Ubuntu1 product
- hhvmAll versions (No fix recorded)
2 vendors · 2 products
References
4 links- github.com/facebook/hhvm/commit/6937de5544c3eead3466b75020d8382080ed0cffX Refsource MISCPatchThird Party Advisory