PatchSiren

PatchSiren cyber security CVE debrief

CVE-2019-11042 Festo Didactic SE CVE debrief

CVE-2019-11042 is an out-of-bounds read in PHP’s EXIF parsing path. In the Festo Didactic MES PC advisory context, the affected software stack is associated with Factory Control Panel/XAMPP on MES PCs. The flaw can cause information disclosure or a crash when EXIF data from an image is processed, including through functions such as exif_read_data().

Vendor
Festo Didactic SE
Product
MES PC
CVSS
HIGH 7.1
CISA KEV
Not listed in stored evidence
Original CVE published
2024-02-27
Original CVE updated
2026-01-27
Advisory published
2024-02-27
Advisory updated
2026-01-27

Who should care

Operators and maintainers of Festo Didactic MES PC deployments, especially teams responsible for the Factory Control Panel/XAMPP software stack and any workflow that ingests untrusted images. Security teams monitoring PHP-based services should also review exposure.

Technical summary

The source advisory states that PHP versions 7.1.x below 7.1.31, 7.2.x below 7.2.21, and 7.3.x below 7.3.8 can be made to read past an allocated buffer while parsing EXIF metadata. The supplied CVSS vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H, which reflects remote reachability with required user interaction and potential confidentiality loss plus high availability impact.

Defensive priority

High

Recommended defensive actions

  • Identify MES PC assets that use Factory Control Panel or any bundled PHP/XAMPP components referenced in the advisory.
  • Move to the current Factory Control Panel release available through Festo technical support, as cited in the source remediation note.
  • If PHP is managed separately, verify EXIF-related components are at or above the fixed versions noted in the advisory: 7.1.31, 7.2.21, or 7.3.8.
  • Reduce exposure to untrusted image content and review any upload, import, or automated processing paths that invoke EXIF parsing.
  • Monitor affected hosts for unexpected application crashes or information-disclosure indicators during image handling workflows.

Evidence notes

The source corpus is a CISA CSAF republication published on 2024-02-27 and modified on 2026-01-27. It explicitly describes the PHP EXIF buffer read issue and links remediation to a Factory Control Panel replacement for XAMPP on MES PCs. The provided source set does not include a KEV listing or threat-campaign entry.

Official resources

Publicly disclosed advisory information republished by CISA. The supplied source set does not indicate KEV inclusion or active exploitation in the wild.