CVE-2016-10161: PHP

High severity, CVSS 7.5. EPSS: 13.3% chance of exploitation in the next 30 days.

The object_common1 function in ext/standard/var_unserializer.c in PHP before 5.6.30, 7.0.x before 7.0.15, and 7.1.x before 7.1.1 allows remote attackers to cause a denial of service (buffer over-read and application crash) via crafted serialized data that is mishandled in a finish_nested_data call.

Affected products

• PHP PHP: up to and including 5.6.29; version 7.0.0 only; version 7.0.1 only; version 7.0.2 only; version 7.0.3 only; version 7.0.4 only; …

Published 2017-01-24. Last modified 2026-06-17.