CVE-2010-2225: PHP

High severity, CVSS 7.5. EPSS: 5.3% chance of exploitation in the next 30 days.

Use-after-free vulnerability in the SplObjectStorage unserializer in PHP 5.2.x and 5.3.x through 5.3.2 allows remote attackers to execute arbitrary code or obtain sensitive information via serialized data, related to the PHP unserialize function.

Affected products

• PHP PHP: version 5.2.0 only; version 5.2.1 only; version 5.2.2 only; version 5.2.3 only; version 5.2.4 only; version 5.2.5 only; …

Published 2010-06-24. Last modified 2026-06-16.