CVE-2016-4071

CRITICAL

Format string vulnerability in the php_snmp_error function in ext/snmp/snmp.c in PHP before 5.5.34, 5.6.x before 5.6.20, and 7.x before 7.0.5 allows remote attackers to execute arbitrary code via format string specifiers in an SNMP::get call.

Published: May 20, 2016 Modified: Jun 17, 2026

CWE-20

CVSS Metrics

CVSSv3

Attack Vector: NETWORK Attack Complexity: LOW Privileges Required: NONE User Interaction: NONE Scope: UNCHANGED Confidentiality Impact: HIGH Integrity Impact: HIGH Availability Impact: HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected Products (79)

Vendor	Product	Version
php	php	5.6.0
php	php	5.6.0
php	php	5.6.0
php	php	5.6.0
php	php	5.6.0
php	php	5.6.0
php	php	5.6.0
php	php	5.6.0
php	php	5.6.0
php	php	5.6.1
php	php	5.6.2
php	php	5.6.3
php	php	5.6.4
php	php	5.6.5
php	php	5.6.6
php	php	5.6.7
php	php	5.6.8
php	php	5.6.9
php	php	5.6.10
php	php	5.6.11

…and 59 more

GitHub Security Advisory GHSA-g8wv-2fpc-qgf8

Format string vulnerability in the php_snmp_error function in ext/snmp/snmp.c in PHP before 5.5...

References (40)

Risk Scores

CVSS Score 9.8 / 10

EPSS Score 19.46%

Top 3% most likely to be exploited

Threat Score 45 / 100

Data Sources

NVD EPSS GitHub