CVE-2016-5114

CVE-2016-5114 is a critical vulnerability affecting PHP versions before 5.5.31, 5.6.17, and 7.0.2, stemming from an incorrect interpretation of the snprintf return value in the FPM logging component. This flaw allows unauthenticated attackers to remotely trigger an out-of-bounds read and buffer overflow by submitting a long string, such as a URI, in configurations with custom REQUEST_URI logging. The potential impact is severe, enabling attackers to obtain sensitive information from process memory or cause a denial of service. Despite its critical CVSS score of 9.1, there is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage.