CVE-2016-5095

CVE-2016-5095 describes an integer overflow vulnerability in the php_escape_html_entities_ex function within PHP versions before 5.5.36 and 5.6.x before 5.6.22. This flaw, an incomplete fix for CVE-2016-5094, allows remote attackers to trigger a denial of service or potentially other unspecified impacts by crafting input that results in a large output string from a FILTER_SANITIZE_FULL_SPECIAL_CHARS filter_var call. With a CVSS score of 8.6 (High), this vulnerability is remotely exploitable with low attack complexity, potentially leading to high impact on availability and low impact on confidentiality and integrity. There is currently no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion surrounding this CVE.