PatchSiren

PatchSiren cyber security CVE debrief

CVE-2019-11041 Festo Didactic SE CVE debrief

CVE-2019-11041 is an out-of-bounds read in PHP's EXIF parser. When exif_read_data() processes crafted image metadata, affected PHP versions can read past an allocated buffer, which may leak memory contents or crash the process. In the supplied CISA/Festo advisory context, the issue is tied to Festo Didactic SE MES PC, and the documented remediation is a replacement Factory Control Panel for MES PCs that includes fixes for these vulnerabilities.

Vendor
Festo Didactic SE
Product
MES PC
CVSS
HIGH 7.1
CISA KEV
Not listed in stored evidence
Original CVE published
2024-02-27
Original CVE updated
2026-01-27
Advisory published
2024-02-27
Advisory updated
2026-01-27

Who should care

Administrators and operators of Festo Didactic SE MES PC systems, especially where the vendor-provided Factory Control Panel/XAMPP stack is in use. Security teams supporting OT/ICS environments should also prioritize review if the installation processes untrusted images through PHP EXIF functionality.

Technical summary

The vulnerability affects PHP 7.1.x below 7.1.31, 7.2.x below 7.2.21, and 7.3.x below 7.3.8. During EXIF parsing, a malformed image can cause PHP to read beyond the allocated buffer, leading to information disclosure or a crash. The supplied CVSS vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H, indicating remote reachability but with user interaction required.

Defensive priority

High

Recommended defensive actions

  • Identify any Festo MES PC installations and confirm whether they use the vendor-provided Factory Control Panel/XAMPP component set.
  • Verify the PHP version in any affected stack and move to a fixed release or the vendor-recommended replacement package.
  • Limit exposure to untrusted image files and review any workflow that automatically imports, previews, or processes images through PHP EXIF parsing.
  • Monitor affected systems for crashes, abnormal PHP behavior, or memory-disclosure indicators around image ingestion paths.
  • Follow CISA ICS recommended practices for segmentation, least privilege, and defensive monitoring on OT/ICS endpoints.

Evidence notes

The source corpus consistently describes a PHP EXIF buffer read-past-allocated-buffer issue that can cause information disclosure or crash. The advisory is a CISA CSAF republication of a Festo notice (tracking ID ICSA-26-027-02 / advisory FSA-202402), and the remediation entry states that Factory Control Panel for MES PCs replaces XAMPP and includes fixes for these vulnerabilities. The provided CVSS vector is AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H. No KEV entry or active-exploitation claim is present in the supplied data.

Official resources

Publicly disclosed in vendor/CISA materials, with the supplied source item published on 2024-02-27 and republished by CISA on 2026-01-27. The provided data does not mark it as a CISA KEV item.