CVE-2016-1000006: Facebook Hhvm

Critical severity, CVSS 9.8. EPSS: 1.6% chance of exploitation in the next 30 days.

hhvm before 3.12.11 has a use-after-free in the serialize_memoize_param() and ResourceBundle::__construct() functions.

Affected products

• Facebook Hhvm: before 3.12.11 (fixed in 3.12.11)

Published 2019-11-19. Last modified 2026-06-17.