CVE-2024-11235

Medium

Published: —Translated: 27/07/2026(UTC)NVD NIST

Summary

In PHP versions 8.3.x before 8.3.19 and 8.4.x before 8.4.5, a code sequence involving the __set handler or ??= operator and exceptions can lead to a use-after-free vulnerability.

Risk Assessment

If a third party can control the memory layout, this could lead to arbitrary code execution or application crashes.

Recommendation

It is recommended to upgrade PHP to versions 8.3.19, 8.4.5 or later.

Original NVD description (English source)

In PHP versions 8.3.* before 8.3.19 and 8.4.* before 8.4.5, a code sequence involving __set handler or ??= operator and exceptions can lead to a use-after-free vulnerability. If the third party can control the memory layout leading to this, for example by supplying specially crafted inputs to the s