# CVE-2018-12882: heap-use-after-free in PHP 7.2 through 7.2.6, possible 7.2.7

Heap use-after-free in PHP 7.2 exif_read_data when parsing a crafted JPEG, causing memory corruption and potential RCE.

- Payout: hidden
- Severity: medium
- Program: Internet Bug Bounty
- Found by: geeknik
- Disclosed: 2018-09-01
- CVE: CVE-2018-12882
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/371135
- Library page: https://bugbountylibrary.com/r/h1%3A371135
- Tags: area:oss domain:oss impact:dos impact:rce kind:bounty platform:hackerone sev:medium tech:php technique:fuzzing vuln:memory-corruption

**Target:** exif_read_data in PHP ext/exif
**Root cause:** exif_read_from_file frees the stream via _php_stream_free but then continues to use the freed stream object, causing a heap use-after-free.
**Steps:**
1. Build PHP 7.2.6 with ASan and run with USE_ZEND_ALLOC=0.
2. Create a 1-byte JPEG: `echo "Lw==" | base64 -d > test.jpg` (single byte 0x2f).
3. Run `USE_ZEND_ALLOC=0 ./php -r 'exif_read_data(file_get_contents("/full/path/to/test.jpg"));'`.
4. Observe ASan heap-use-after-free in _php_stream_free called from exif_read_from_file.
**Exploitation:** Not demonstrated beyond the ASan crash; impact claimed as DoS, memory corruption, info disclosure, RCE.
**Insight:** Malformed/truncated image files that fail early in EXIF parsing can leave stream handles in a freed-but-reused state; fuzz EXIF parsers with tiny invalid files, not just well-formed JPEGs.