CVE-2026-7262

NULL pointer dereference in SOAP apache:Map decoder with missing <value>

HIGH

7.5

CVSS Score

Published: May 10, 2026 at 04:00 AM UTC

Updated: July 24, 2026 at 08:23 AM UTC

1 product affected across 1 vendorPHP

Using PHP by PHP Group?

Get instant alerts when new vulnerabilities affect PHP - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

HIGH7.5

Exploit prediction

EPSS 0.8%

SSVC

No known exploit

Description

In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, when a SOAP server has a typemap configured, the decoding process contains a mistake which checks the wrong variable in case of missing value element. This leads to dereferences a NULL pointer, causing a segmentation fault. This allows a remote unauthenticated attacker to crash the PHP SOAP server process, resulting in denial of service.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

PHP · PHPdrupal

95%

8.2.* ≤ v < 8.2.318.2.0 ≤ v < 8.2.318.3.* ≤ v < 8.3.318.3.0 ≤ v < 8.3.318.4.* ≤ v < 8.4.218.4.0 ≤ v < 8.4.218.5.* ≤ v < 8.5.68.5.0 ≤ v < 8.5.68.2.*8.3.*8.4.*8.5.*

Affected range stops below 8.2.31, so it looks safe — our inference, not a vendor statement

Affected range stops below 8.3.31, so it looks safe — our inference, not a vendor statement

Affected range stops below 8.4.21, so it looks safe — our inference, not a vendor statement

Affected range stops below 8.5.6, so it looks safe — our inference, not a vendor statement

Remediation

No guide yet

No remediation guidance has been written for this CVE yet. What the record does show:

Patch and advisory references

https://github.com/php/php-src/security/advisories/GHSA-hmxp-6pc4-f3vv