CVE-2016-10158: PHP

High severity, CVSS 7.5. EPSS: 7.8% chance of exploitation in the next 30 days.

The exif_convert_any_to_int function in ext/exif/exif.c in PHP before 5.6.30, 7.0.x before 7.0.15, and 7.1.x before 7.1.1 allows remote attackers to cause a denial of service (application crash) via crafted EXIF data that triggers an attempt to divide the minimum representable negative integer by -1.

Affected products

• PHP PHP: up to and including 5.6.29; version 7.0.0 only; version 7.0.1 only; version 7.0.2 only; version 7.0.3 only; version 7.0.4 only; …

Published 2017-01-24. Last modified 2026-06-17.