CVE-2007-1380

CVE-2007-1380 describes an information disclosure vulnerability in the php_binary serialization handler within the session extension of PHP versions prior to 4.4.5 and 5.2.1. An attacker can exploit this by providing a serialized variable entry with an excessively large length value, leading to a buffer over-read and exposure of sensitive memory contents. This vulnerability has a CVSS score of 5.0, indicating a medium severity, and can be exploited remotely with low attack complexity and no authentication required, resulting in partial confidentiality impact. While not actively exploited in the wild or on CISA's KEV catalog, an ExploitDB entry (EDB-3413) exists, and it has garnered minimal community discussion or media coverage.