CVE-2016-1903: PHP

Critical severity, CVSS 9.1. EPSS: 7.8% chance of exploitation in the next 30 days.

The gdImageRotateInterpolated function in ext/gd/libgd/gd_interpolation.c in PHP before 5.5.31, 5.6.x before 5.6.17, and 7.x before 7.0.2 allows remote attackers to obtain sensitive information or cause a denial of service (out-of-bounds read and application crash) via a large bgd_color argument to the imagerotate function.

Affected products

• PHP PHP: up to and including 5.5.30; version 5.6.0 only; version 5.6.1 only; version 5.6.2 only; version 5.6.3 only; version 5.6.4 only; …

Published 2016-01-19. Last modified 2026-06-17.