CVE-2026-7261

Description

In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, when SoapServer is configured with SOAP_PERSISTENCE_SESSION, the handler object is persisted across requests via session storage. However, in the case SOAP requests results in an error, the persistance is handled incorrectly, resulting in freeing the object while keeping a pointer to it, which may lead to use-after-free. This may lead to memory corruption, information disclosure, or process crashes, with confidentiality, integrity, and availability impact on the vulnerable system.

How to fix CVE-2026-7261

To remediate CVE-2026-7261, upgrade the affected package to a fixed version below.

• —upgrade to 8.2.31 or later
• —upgrade to 8.2.31 or later
• —upgrade to 8.2.31 or later
• —upgrade to 7.4.33-1+deb11u11 or later
• —upgrade to 8.2.31-1~deb12u1 or later
• —upgrade to 8.4.21-1~deb13u1 or later

Is CVE-2026-7261 being exploited?

Low — EPSS is 0.1%, meaning exploitation activity has not been observed at scale.

Affected packages (6)

• >= 8.2.0, < 8.2.31, >= 8.3.0, < 8.3.31, >= 8.4.0, < 8.4.21, >= 8.5.0, < 8.5.6
• >= 8.2.0, < 8.2.31, >= 8.3.0, < 8.3.31, >= 8.4.0, < 8.4.21, >= 8.5.0, < 8.5.6
• >= 8.2.0, < 8.2.31, >= 8.3.0, < 8.3.31, >= 8.4.0, < 8.4.21, >= 8.5.0, < 8.5.6
• from 0, < 7.4.33-1+deb11u11
• from 0, < 8.2.31-1~deb12u1
• from 0, < 8.4.21-1~deb13u1

CVSS scores

References (3)

• ADVISORYsecurity-tracker.debian.org/tracker/CVE-2026-7261
• WEBgithub.com/php/php-src/security/advisories/GHSA-m33r-qmcv-p97q
• WEBnvd.nist.gov/vuln/detail/CVE-2026-7261