Skip to main content

PHP 8.2 CVE-2026-6722

| EUVDEUVD-2026-28966 CRITICAL
Use After Free (CWE-416)
2026-05-07
Microsoft PHP Use After Free Memory Corruption Information Disclosure
9.5
CVSS 4.0 · Vendor
Share

Severity by source

Vendor (CNA) PRIMARY
9.5 CRITICAL
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:X/V:X/RE:M/U:Red
SUSE
9.8 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat
7.7 HIGH
qualitative

Primary rating from Vendor (CNA).

CVSS VectorVendor

CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:X/V:X/RE:M/U:Red
Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

5
Source Code Evidence Fetched
May 10, 2026 - 05:24 vuln.today
Analysis Generated
May 10, 2026 - 05:24 vuln.today
CVSS changed
May 10, 2026 - 05:22 NVD
9.5 (CRITICAL)
CVE Published
May 07, 2026 - 17:18 nvd
UNKNOWN (no severity yet)
CVE Published
May 07, 2026 - 17:18 nvd
CRITICAL 9.5

Description PRE-NVD

Disclosed via GitHub release of php/php-src. NVD scoring and full description are pending.

AnalysisAI

Use-after-free memory corruption in PHP 8.2.x enables remote attackers to achieve high-impact exploitation through network-accessible attack vectors, despite high attack complexity and specific timing requirements. PHP 8.2.31 addresses this vulnerability along with seven other security issues in a coordinated security release. The CVSS v4.0 score of 9.5 reflects both confidentiality and integrity impact across vulnerable and subsequent systems, with high availability impact. No public exploit code or active exploitation confirmed at time of analysis, but the vendor urgency indicator (U:Red) and release coordinator emphasis (RE:M) signal critical priority for organizations running PHP 8.2.x in production environments.

Technical ContextAI

This vulnerability is classified as CWE-416 (Use After Free), a memory safety issue where PHP attempts to access heap memory after it has been freed. Use-after-free vulnerabilities in PHP typically occur in the Zend Engine's memory management, object lifecycle handling, or extension-specific resource cleanup paths. The affected component runs in web server contexts (Apache mod_php, PHP-FPM, CGI) where memory corruption can be triggered through crafted HTTP requests processing user input. The CVSS v4.0 vector indicates network attack vector (AV:N) with high complexity (AC:H) and specific attack requirements during preparation (AT:P), suggesting the vulnerability requires precise timing or race condition exploitation. Tags indicate Microsoft platform relevance and information disclosure potential alongside memory corruption, suggesting the vulnerability may leak sensitive data from freed memory before or during exploitation. PHP 8.2.x uses reference counting and garbage collection that can create exploitable windows when objects are prematurely freed while still referenced.

RemediationAI

Upgrade immediately to PHP 8.2.31, available from https://www.php.net/downloads.php with Windows binaries at https://www.php.net/downloads.php?os=windows&version=8.2 per the official release announcement at https://github.com/php/php-src/releases/tag/php-8.2.31. For production environments requiring staged rollouts, test PHP 8.2.31 in non-production first as this bundled security release addresses eight CVEs with potential for behavioral changes. If immediate upgrade is not feasible, implement network segmentation to restrict PHP application access to trusted sources only, reducing attack surface for the network-based exploit vector. Deploy web application firewall (WAF) rules to detect and block requests with anomalous object manipulation patterns, though effectiveness is limited given the use-after-free trigger conditions are likely deep in PHP's internal processing rather than easily signature-detectable inputs. Monitor PHP error logs and system crash dumps for segmentation faults or memory corruption indicators that could signal exploitation attempts. Note that workarounds provide only partial risk reduction-the high CVSS score and vendor red urgency rating indicate patch deployment is the only complete remediation. Organizations running PHP 8.2.x should also review whether migration to actively supported PHP 8.3.x or 8.4.x branches is appropriate as part of longer-term maintenance strategy.

More in PHP

View all
CVE-2012-1823 CRITICAL POC
9.8 May 11

sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
CVE-2016-1555 CRITICAL POC
9.8 Apr 21

(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
CVE-2024-11680 CRITICAL POC
9.8 Nov 26

ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
CVE-2025-49113 CRITICAL POC
9.9 Jun 02

Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
CVE-2017-9841 CRITICAL POC
9.8 Jun 27

Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
CVE-2025-0108 HIGH POC
8.8 Feb 12

Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers

CVE-2021-25298 HIGH POC
8.8 Feb 15

Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
CVE-2021-25296 HIGH POC
8.8 Feb 15

Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
CVE-2013-4983 CRITICAL POC
10.0 Sep 10

The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
CVE-2023-6553 CRITICAL POC
9.8 Dec 15

The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
CVE-2024-46506 CRITICAL POC
10.0 May 13

NetAlertX (formerly PiAlert) versions 23.01.14 through 24.x before 24.10.12 allow unauthenticated command injection thro
CVE-2024-8353 CRITICAL POC
9.8 Sep 28

The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all

Same weakness CWE-416 – Use After Free

View all
CVE-2019-0708 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2014-0322 HIGH POC
8.8
CVE-2012-4792 HIGH POC
8.8
CVE-2009-4324 HIGH POC
7.8
CVE-2015-0313 CRITICAL POC
9.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2013-2551 HIGH POC
8.8

Same technique Use After Free

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2014-0322 HIGH POC
8.8
CVE-2012-4792 HIGH POC
8.8
CVE-2009-4324 HIGH POC
7.8
CVE-2015-0313 CRITICAL POC
9.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2013-2551 HIGH POC
8.8
CVE-2012-4969 HIGH POC
8.1

Vendor StatusVendor

SUSE

Severity: Critical
Product Status
openSUSE Tumbleweed Fixed
SUSE Linux Enterprise Module for Web and Scripting 15 SP7 Affected
SUSE Linux Enterprise Server 15 SP7 Affected
SUSE Linux Enterprise Server for SAP Applications 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected

Share

CVE-2026-6722 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy