Web Application Vulnerabilities Runtime SCA Findings
Looking for the vulnerability index of Invicti's legacy products?
Invicti Enterprise Acunetix Standard & Premium
PHP Use After Free Vulnerability - CVE-2026-7261 - Vulnerability Database
PHP

PHP Use After Free Vulnerability - CVE-2026-7261

Critical
Reference: CVE-2026-7261
NVD Link: https://nvd.nist.gov/vuln/detail/CVE-2026-7261
Title: PHP Use After Free Vulnerability
Overview:

In PHP versions 8.2. before 8.2.31 8.3. before 8.3.31 8.4. before 8.4.21 and 8.5. before 8.5.6 when SoapServer is configured with SOAP_PERSISTENCE_SESSION the handler object is persisted across requests via session storage. However in the case SOAP requests results in an error the persistance is handled incorrectly resulting in freeing the object while keeping a pointer to it which may lead to use-after-free. This may lead to memory corruption information disclosure or process crashes with confidentiality integrity and availability impact on the vulnerable system.