Use-After-Free Vulnerability in PHP Products by PHP Group

CVE-2024-11235

What is CVE-2024-11235?

In PHP versions 8.3.* prior to 8.3.19 and 8.4.* prior to 8.4.5, a vulnerability exists that allows an attacker to leverage a code sequence involving the __set handler or the ??= operator together with exceptions. This can lead to a use-after-free condition due to improper handling of memory, especially if the attacker can control memory layout through specially crafted inputs. Successfully exploiting this vulnerability could allow an attacker to execute arbitrary code, posing a significant risk to the integrity and security of applications utilizing the affected PHP versions.

References