CVE-2024-11235
Reference counting in php_request_shutdown causes Use-After-Free
- State
- Published
- Severity
- 9.2 Critical
- Published
- Apr 4, 2025
- Updated
- Feb 26, 2026
- Reserved
- Nov 15, 2024
Description
In PHP versions 8.3.* before 8.3.19 and 8.4.* before 8.4.5, a code sequence involving __set handler or ??= operator and exceptions can lead to a use-after-free vulnerability. If the third party can control the memory layout leading to this, for example by supplying specially crafted inputs to the script, it could lead to remote code execution.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 9.2 Critical | CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/U:Amber | php |
Weaknesses
- CWE-416 Use After Free
Affected Products
| Product | Versions |
|---|---|
PHPPHP Group |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.