CVE-2019-11049

score

<0.1

cvss

6.5

epss

4.2%

published

2019-12-23

kev added

—

first seen

2026-10-21

PHP versions 7.3.x below 7.3.13 and 7.4.0 on Windows contain a double-free vulnerability caused by mishandling of custom headers in mail() function due to a mistake in commit 78f4b4a2dcf92ddbccea1bb95f8390a18ac3342e, letting attackers cause memory corruption, exploit requires supplying headers in lowercase.