CVE-2016-7133: PHP

High severity, CVSS 8.1. EPSS: 4.1% chance of exploitation in the next 30 days.

Zend/zend_alloc.c in PHP 7.x before 7.0.10, when open_basedir is enabled, mishandles huge realloc operations, which allows remote attackers to cause a denial of service (integer overflow) or possibly have unspecified other impact via a long pathname.

Affected products

• PHP PHP: version 7.0.0 only; version 7.0.1 only; version 7.0.2 only; version 7.0.3 only; version 7.0.4 only; version 7.0.5 only; …

Published 2016-09-12. Last modified 2026-06-17.