Object Deduplication Vulnerability in PHP SOAP Extension by The PHP Group

CVE-2026-6722

What is CVE-2026-6722?

The PHP SOAP extension contains a vulnerability in its object deduplication mechanism across several PHP versions. This issue arises because pointers to PHP objects are stored in a global map without properly managing their reference counts. In scenarios where duplicate keys exist, the mechanism replaces the original entry with a new one, inadvertently freeing the original object while a stale pointer remains. This leads to a use-after-free condition whereby an adversary controlling the SOAP request body can exploit the vulnerability, potentially leading to remote code execution through dereferencing a dangling pointer. This underscores the importance of keeping PHP versions updated to safeguard against such vulnerabilities.

References