CVE-2016-5093

CVE-2016-5093 describes an out-of-bounds read vulnerability in the get_icu_value_internal function within PHP versions prior to 5.5.36, 5.6.22, and 7.0.7. This flaw, stemming from a missing null terminator, allows remote attackers to trigger a denial of service or potentially other impacts through a crafted locale_get_primary_language call. Rated with a CVSSv3 score of 8.6 (High), it presents a low-complexity attack vector that does not require user interaction or privileges, leading to high availability impact and low confidentiality/integrity impact. Despite its high severity, there is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage, suggesting a low current threat landscape.