CVE-2016-5772

Critical

Published: 07/08/2016(UTC)Translated: 14/06/2026(UTC)NVD NIST

Summary

A double free vulnerability in the php_wddx_process_data function in the WDDX extension in PHP before 5.5.37, 5.6.x before 5.6.23, and 7.x before 7.0.8 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via crafted XML data that is mishandled in a wddx_deserialize call.

Risk Assessment

Organizations may be exposed to attacks that lead to application crashes or unauthorized code execution, potentially resulting in data loss or system security breaches.

Recommendation

It is recommended to update PHP to the latest version to mitigate this vulnerability and to review and secure applications using WDDX against potential attacks.

Original NVD description (English source)

Double free vulnerability in the php_wddx_process_data function in wddx.c in the WDDX extension in PHP before 5.5.37, 5.6.x before 5.6.23, and 7.x before 7.0.8 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via crafted XML data that is mishandled in a wddx_deserialize call.