Skip to main content

PHP EUVDEUVD-2026-28971

| CVE-2026-7262 LOW
NULL Pointer Dereference (CWE-476)
2026-05-07
Denial Of Service Microsoft PHP Null Pointer Dereference
2.9
CVSS 4.0 · Vendor

Severity by source

Vendor (CNA) PRIMARY
2.9 LOW
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:X/V:X/RE:M/U:Amber

Primary rating from Vendor (CNA) · only source for this CVE.

CVSS VectorVendor

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:X/V:X/RE:M/U:Amber
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

5
Source Code Evidence Fetched
May 10, 2026 - 05:25 vuln.today
Analysis Generated
May 10, 2026 - 05:25 vuln.today
CVSS changed
May 10, 2026 - 05:22 NVD
2.9 (LOW)
CVE Published
May 07, 2026 - 17:18 nvd
UNKNOWN (no severity yet)
CVE Published
May 07, 2026 - 17:18 nvd
LOW 2.9

Description PRE-NVD

Disclosed via GitHub release of php/php-src. NVD scoring and full description are pending.

AnalysisAI

PHP 8.2.31 addresses a null pointer dereference vulnerability (CVE-2026-7262) that can cause denial of service through remote network access without authentication. The vulnerability has a low CVSS score of 2.9 due to attack complexity factors, but the vendor has released PHP 8.2.31 as an immediate security patch addressing this and seven related CVEs. All PHP 8.2 users should upgrade to mitigate the impact.

Technical ContextAI

CVE-2026-7262 is rooted in CWE-476 (Null Pointer Dereference), a memory safety issue where PHP code attempts to dereference a null pointer, typically in core language constructs or built-in function handlers. The CVSS vector indicates network accessibility (AV:N) with low complexity (AC:L) but temporal attack complexity factor (AT:P), suggesting the exploit requires specific timing or preconditions. The vulnerability affects PHP 8.2.x versions across the language interpreter, potentially triggered through crafted input to specific functions or language features that lack proper null-pointer validation.

RemediationAI

Upgrade immediately to PHP 8.2.31 or later, available from https://www.php.net/downloads.php and https://github.com/php/php-src/releases/tag/php-8.2.31. For Windows systems, precompiled binaries are available at https://www.php.net/downloads.php?os=windows&version=8.2. For systems unable to patch immediately, implement network-level rate limiting on PHP application entry points to reduce the impact of remote DoS attempts, though this does not prevent the vulnerability itself. Disable or restrict access to any PHP features known to be affected by null-pointer dereference issues if documentation is available from vendor advisories; however, this is a defensive measure only and does not substitute for patching. Monitor PHP error logs for segmentation faults or null-pointer-related crashes as an early indicator of exploitation attempts.

More in PHP

View all
CVE-2012-1823 CRITICAL POC
9.8 May 11

sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
CVE-2016-1555 CRITICAL POC
9.8 Apr 21

(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
CVE-2024-11680 CRITICAL POC
9.8 Nov 26

ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
CVE-2025-49113 CRITICAL POC
9.9 Jun 02

Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
CVE-2017-9841 CRITICAL POC
9.8 Jun 27

Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
CVE-2025-0108 HIGH POC
8.8 Feb 12

Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers

CVE-2021-25298 HIGH POC
8.8 Feb 15

Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
CVE-2021-25296 HIGH POC
8.8 Feb 15

Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
CVE-2013-4983 CRITICAL POC
10.0 Sep 10

The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
CVE-2023-6553 CRITICAL POC
9.8 Dec 15

The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
CVE-2024-46506 CRITICAL POC
10.0 May 13

NetAlertX (formerly PiAlert) versions 23.01.14 through 24.x before 24.10.12 allow unauthenticated command injection thro
CVE-2024-8353 CRITICAL POC
9.8 Sep 28

The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all

Same weakness CWE-476 – NULL Pointer Dereference

View all
CVE-2016-0742 HIGH
7.5
CVE-2014-3470 MEDIUM
4.3
CVE-2017-3730 HIGH POC
7.5
CVE-2017-3169 CRITICAL POC
9.8
CVE-2016-4957 HIGH
7.5
CVE-2015-3194 HIGH
7.5
CVE-2026-21525 MEDIUM
6.2
CVE-2017-0016 MEDIUM
5.9

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Share

EUVD-2026-28971 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy