PHP 8.28.5 SOAP UAF RCE via dangling pointer
CVE-2026-6722 Published on May 10, 2026
Use-After-Free in SOAP using Apache map
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.
Weakness Type
What is a Dangling pointer Vulnerability?
Referencing memory after it has been freed can cause a program to crash, use unexpected values, or execute code.
CVE-2026-6722 has been classified to as a Dangling pointer vulnerability or weakness.
Products Associated with CVE-2026-6722
Want to know whenever a new CVE is published for PHP? stack.watch will email you.
Affected Versions
PHP Group PHP:- Version 8.2.* and below 8.2.31 is affected.
- Version 8.3.* and below 8.3.31 is affected.
- Version 8.4.* and below 8.4.21 is affected.
- Version 8.5.* and below 8.5.6 is affected.