CVE-2016-7411

Critical

Published: 17/09/2016(UTC)Translated: 14/06/2026(UTC)NVD NIST

Summary

In PHP before version 5.6.26, there is an issue with handling object-deserialization failures, which can lead to denial of service due to memory corruption or other unspecified impacts.

Risk Assessment

Remote attackers may exploit this vulnerability to disrupt application functionality, potentially leading to downtime and loss of service availability.

Recommendation

It is recommended to upgrade PHP to version 5.6.26 or later to mitigate this vulnerability.

Original NVD description (English source)

ext/standard/var_unserializer.re in PHP before 5.6.26 mishandles object-deserialization failures, which allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via an unserialize call that references a partially constructed object.