PT-2026-39444 · Php+2 · Php+2
Brettgervasoni
+2
·
Published
2026-05-07
·
Updated
2026-06-18
·
CVE-2026-6722
CVSS v3.1
9.8
Critical
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
PHP versions 8.2.0 through 8.2.30
PHP versions 8.3.0 through 8.3.30
PHP versions 8.4.0 through 8.4.20
PHP versions 8.5.0 through 8.5.5
Description
A use-after-free issue exists in the SOAP extension's object deduplication mechanism, specifically within the
soap add xml ref() function. The mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, the second entry overwrites the first in the temporary result map, freeing the original PHP object while a stale pointer remains. A subsequent href reference to the freed node can copy this dangling pointer into the result. Since PHP string allocations can reclaim the freed memory region, a remote attacker controlling the SOAP request body can exploit this to achieve remote code execution.Recommendations
Update PHP version 8.2.x to 8.2.31
Update PHP version 8.3.x to 8.3.31
Update PHP version 8.4.x to 8.4.21
Update PHP version 8.5.x to 8.5.6
Fix
RCE
Use After Free
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Linuxmint
Php
Ubuntu