CVE-2016-5768
CriticalSummary
A double free vulnerability in the _php_mb_regex_ereg_replace_exec function in php_mbregex.c in the mbstring extension in PHP before 5.5.37, 5.6.x before 5.6.23, and 7.x before 7.0.8 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) by leveraging a callback exception.
Risk Assessment
Organizations may be exposed to remote code execution or application crashes, which can lead to service unavailability and potential data leakage.
Recommendation
It is recommended to update PHP to the latest version to mitigate this vulnerability and to monitor systems for potential attack attempts.
Original NVD description (English source)
Double free vulnerability in the _php_mb_regex_ereg_replace_exec function in php_mbregex.c in the mbstring extension in PHP before 5.5.37, 5.6.x before 5.6.23, and 7.x before 7.0.8 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) by leveraging a callback exception.