PT-2026-39449 · Php · Php

Ilia Alshanetsky + 1 · Published 2026-05-10 · Updated 2026-05-10 · CVE-2026-7262

Mitre

CVSS v4.0

2.9

Low

Base vector

AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/AU:Y/RE:M/U:Amber

In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, when a SOAP server has a typemap configured, the decoding process contains a mistake which checks the wrong variable in case of missing value element.  This leads to dereferences a NULL pointer, causing a segmentation fault. This allows a remote unauthenticated attacker to crash the PHP SOAP server process, resulting in denial of service.

Fix

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

CVE-2026-7262

Affected Products

Php

References · 2

• https://nvd.nist.gov/vuln/detail/CVE-2026-7262 · Security Note
• https://github.com/php/php-src/security/advisories/GHSA-hmxp-6pc4-f3vv · Vendor Advisory