CVE-2007-1484: PHP

Medium severity, CVSS 4.6. EPSS: 1.1% chance of exploitation in the next 30 days.

The array_user_key_compare function in PHP 4.4.6 and earlier, and 5.x up to 5.2.1, makes erroneous calls to zval_dtor, which triggers memory corruption and allows local users to bypass safe_mode and execute arbitrary code via a certain unset operation after array_user_key_compare has been called.

Affected products

• PHP PHP: up to and including 4.4.6; from 5.0.0, up to and including 5.2.1

Published 2007-03-16. Last modified 2026-06-16.