CVE-2016-7479: PHP

Critical severity, CVSS 9.8. EPSS: 41.7% chance of exploitation in the next 30 days.

In all versions of PHP 7, during the unserialization process, resizing the 'properties' hash table of a serialized object may lead to use-after-free. A remote attacker may exploit this bug to gain arbitrary code execution.

Affected products

• PHP PHP: version 7.0.0 only; version 7.0.1 only; version 7.0.2 only; version 7.0.3 only; version 7.0.4 only; version 7.0.5 only; …

Published 2017-01-12. Last modified 2026-06-17.