Is there a patch available for CVE-2026-7259?

Yes, a patch is available for CVE-2026-7259. Update the affected software to the latest version immediately.

PHP CVE-2026-7259

Q: What is the CVSS score of CVE-2026-7259?

CVE-2026-7259 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:X/V:X/RE:X/U:Amber. EPSS exploitation probability: 0.0%.

EUVD-2026-28969 LOW

NULL Pointer Dereference (CWE-476)

2026-05-07

Denial Of Service Microsoft PHP Null Pointer Dereference

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:X/V:X/RE:X/U:Amber

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:X/V:X/RE:X/U:Amber

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Source Code Evidence Fetched

May 10, 2026 - 05:24 vuln.today

Analysis Generated

May 10, 2026 - 05:24 vuln.today

CVSS changed

May 10, 2026 - 05:22 NVD

2.1 (LOW)

CVE Published

May 07, 2026 - 17:18 nvd

UNKNOWN (no severity yet)

CVE Published

May 07, 2026 - 17:18 nvd

LOW 2.1

Description PRE-NVD

Disclosed via GitHub release of php/php-src. NVD scoring and full description are pending.

AnalysisAI

Null pointer dereference in PHP 8.2.x causes denial of service through remote attacks requiring user interaction and persistent attack timing. CVE-2026-7259 is one of eight vulnerabilities patched in PHP 8.2.31, with a low CVSS score (2.1) reflecting the attack complexity and limited availability impact, though the null pointer dereference class (CWE-476) can escalate in severity depending on code context. No public exploit code or active exploitation has been identified at time of analysis.

Technical ContextAI

CVE-2026-7259 is a null pointer dereference vulnerability (CWE-476) in PHP's core runtime or extension handling. Null pointer dereferences occur when code attempts to access or dereference a memory pointer that points to null, typically resulting in immediate crashes or undefined behavior. In PHP, this type of vulnerability commonly manifests in C-level code within the Zend Engine or PHP extensions when input validation fails to check for null conditions before dereferencing pointers. The CVSS vector indicates the vulnerability requires specific attack timing (AT:P - persistent/repeated attacks) and user interaction (UI:A), suggesting the null pointer may only dereference under specific runtime conditions or in response to crafted user-supplied input. The Microsoft tag and Windows binary availability in PHP 8.2.31 release notes indicate Windows environments are explicitly supported in remediation.

RemediationAI

Upgrade to PHP 8.2.31 or later. Download patched binaries and source code from https://www.php.net/downloads.php (Windows binaries also available at https://www.php.net/downloads.php?os=windows&version=8.2). Verify the ChangeLog at https://www.php.net/ChangeLog-8.php#8.2.31 to confirm all eight CVEs including CVE-2026-7259 are addressed in your installed version. For users unable to patch immediately, implement input validation and sanitization on all user-supplied data passed to PHP code, though this is a defense-in-depth measure and not a substitute for patching. Consider restricting PHP script execution to trusted input sources and enable PHP's strict type checking (declare(strict_types=1)) where possible to catch null dereferences earlier in development. No significant side effects are expected from upgrading to PHP 8.2.31; test in non-production environments first as with any security update.