Use After Free in PHP

CVE-2026-6722

In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.

Vulnerability class: Use-After-Free

Published · last modified .

CVSS v3 metric

CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

EPSS exploit prediction

EPSS: 0.013 (69.9th percentile), scored .

Low probability of exploitation in the next 30 days, but still tracked. 70th percentile — 69.9% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS trend (30 days)EPSS over the last 30 days for CVE-2026-6722: held from 0.009 to 0.013.

EPSS over last 30 days · oldest: 0.009 · newest: 0.013 · change: +0.004

Affected products

Weakness classification (CWE)

References

Frequently asked questions

What is CVE-2026-6722?
CVE-2026-6722 is a critical-severity vulnerability in PHP, classified under Use After Free. CVSS score: 9.8/10. Published 2026-05-10.
How severe is CVE-2026-6722?
Critical severity. CVSS v3 base score is 9.8 out of 10.