CVE-2026-7262

HighCVSS 7.5/10Last modified Jul 24, 2026

Description

In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, when a SOAP server has a typemap configured, the decoding process contains a mistake which checks the wrong variable in case of missing value element. This leads to dereferences a NULL pointer, causing a segmentation fault. This allows a remote unauthenticated attacker to crash the PHP SOAP server process, resulting in denial of service.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-476

Affected software

Vendor	Product	Versions
PHP Group	PHP	>= 8.2., < 8.2.31; >= 8.3., < 8.3.31; >= 8.4., < 8.4.21; >= 8.5., < 8.5.6
Red Hat	Red Hat Enterprise Linux 10	—
Red Hat	Red Hat Enterprise Linux 10	—
Red Hat	Red Hat Enterprise Linux 8	—
Red Hat	Red Hat Enterprise Linux 8	—
Red Hat	Red Hat Enterprise Linux 9	—
Red Hat	Red Hat Enterprise Linux 9	—
Red Hat	Red Hat Enterprise Linux 9	—
Red Hat	Red Hat Enterprise Linux 6	—
Red Hat	Red Hat Enterprise Linux 7	—
Red Hat	Red Hat Hardened Images	—

References

Timeline

Published: May 10, 2026
Last modified: Jul 24, 2026
NVD status: Modified

Related CVEs from 2026

CVE-2026-726265.4Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipu CVE-2026-726275.4Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipu CVE-2026-726286.5Improper Handling of Highly Compressed Data (CWE-409) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An aut CVE-2026-726297.1Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to unauthorized cross-space access via Accessing Functionality CVE-2026-72637.5In PHP versions 8.4.* before 8.4.21 and 8.5.* before 8.5.6, DOMNode::C14N() method may process the XML data incorrectly, causing a circular CVE-2026-726307.1Incorrect Authorization (CWE-863) in Kibana Fleet can lead to privilege escalation via Privilege Abuse (CAPEC-122). Fleet restricts some cal CVE-2026-726316.5Improper Privilege Management (CWE-269) in Kibana Fleet can lead to privilege escalation via Privilege Escalation (CAPEC-233). An integratio CVE-2026-726327.1Observable Discrepancy (CWE-203) in Kibana Fleet can lead to information disclosure via Excavation (CAPEC-116). Fleet removes the Elasticsea CVE-2026-726334.3Incorrect Authorization (CWE-863) in Kibana Entity Analytics can lead to a loss of security monitoring via Accessing Functionality Not Prope CVE-2026-726366.5Uncontrolled Recursion (CWE-674) in the Elasticsearch wildcard matching helper can lead to a denial of service via Excessive Allocation (CAP CVE-2026-726386.5Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to denial of service via Input Data Manipulation (CAPEC-153). An authenticated us CVE-2026-726396.5Elasticsearch does not enforce an upper bound on a user-supplied count accepted by a search highlighting option, and the allocation derived