PT-2026-39449 · Php+3 · Php+3

Ilia Alshanetsky + 1 · Published 2026-05-07 · Updated 2026-06-04 · CVE-2026-7262

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions PHP versions 8.2.0 through 8.2.30 PHP versions 8.3.0 through 8.3.30 PHP versions 8.4.0 through 8.4.20 PHP versions 8.5.0 through 8.5.5

Description A mistake in the decoding process of a SOAP server with a configured typemap causes the system to check the wrong variable when a value element is missing. This results in a NULL pointer dereference, leading to a segmentation fault. A remote unauthenticated attacker can exploit this to crash the PHP SOAP server process, causing a denial of service.

Recommendations Update PHP version 8.2.x to 8.2.31 Update PHP version 8.3.x to 8.3.31 Update PHP version 8.4.x to 8.4.21 Update PHP version 8.5.x to 8.5.6

Fix

DoS

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

ALSA-2026:22142

ALSA-2026:22143

ALSA-2026:22305

ALSA-2026:23388

BIT-LIBPHP-2026-7262

BIT-PHP-2026-7262

BIT-PHP-MIN-2026-7262

CVE-2026-7262

OESA-2026-2340

OESA-2026-2341

OESA-2026-2342

OESA-2026-2343

OESA-2026-2344

OPENSUSE-SU-2026:10747-1

USN-8336-1

Affected Products

Linuxmint

Php

Rocky Linux

Ubuntu

References · 83

• https://github.com/php/php-src/security/advisories/GHSA-hmxp-6pc4-f3vv · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-7261 · Security Note
• https://errata.rockylinux.org/RLSA-2026:22305 · Vendor Advisory
• https://osv.dev/vulnerability/BELL-CVE-2026-7262 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2026-2341 · Vendor Advisory
• https://errata.almalinux.org/9/ALSA-2026-22142.html · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:10747-1 · Vendor Advisory
• https://safe-surf.ru/specialists/bulletins-nkcki/732061 · Security Note
• https://osv.dev/vulnerability/USN-8336-1 · Vendor Advisory
• https://errata.rockylinux.org/RLSA-2026:22143 · Vendor Advisory
• https://osv.dev/vulnerability/ALSA-2026:23388 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-6735 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-7263 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-7258 · Security Note
• https://ubuntu.com/security/CVE-2025-14179 · Vendor Advisory