Unknown · Gd Extension · CVE-2022-31630
**Name of the Vulnerable Software and Affected Versions**
PHP versions prior to 7.4.33, 8.0.25 and 8.1.12
**Description**
The issue is related to the `imageloadfont()` function in the gd extension, which can be exploited by providing a specially crafted font file. When the loaded font is used with the `imagechar()` function, it can lead to reading outside the allocated buffer, resulting in crashes or disclosure of confidential information.
**Recommendations**
For PHP versions prior to 7.4.33, update to version 7.4.33 or later.
For PHP versions prior to 8.0.25, update to version 8.0.25 or later.
For PHP versions prior to 8.1.12, update to version 8.1.12 or later.
As a temporary workaround, consider disabling the `imageloadfont()` function in the gd extension until a patch is available.
Restrict access to the gd extension to minimize the risk of exploitation.
Avoid using the `imagechar()` function with loaded fonts from untrusted sources until the issue is resolved.