PHP SOAP Extension Flaw Could Let Attackers Execute Code Remotely

Recently disclosed vulnerabilities in PHP, particularly within its widely used SOAP extension, have raised significant alarms across the cybersecurity community.

Among the newly identified flaws is a high-severity vulnerability that could permit attackers to achieve Remote Code Execution (RCE) on affected servers.

Several other moderate-severity flaws, including Use-After-Free (UAF) bugs, NULL pointer dereferences, and out-of-bounds reads, were also discovered across various PHP core modules.

Cybersecurity professionals and system administrators, please apply patches immediately to protect your environments from potential exploitation. Historically, the PHP SOAP extension has been a prime target for attackers, with prior flaws such as CVE-2021-21702 enabling unauthenticated Denial-of-Service attacks via malformed XML.

The complexity of XML processing continues to introduce subtle memory management bugs that advanced threat actors can weaponize.

PHP SOAP Extension Flaw

The most critical of the newly published vulnerabilities, CVE-2026-6722, is a High-severity Use-After-Free (UAF) flaw in the ext-soap package.

The issue stems from how the extension deduplicates objects in the XML graph using the id and href attributes.

During XML graph traversal, PHP stores plain objects in a hash map known as SOAP_GLOBAL(ref_map). Crucially, the PHP object’s reference count is not properly incremented during this memory allocation.

Attackers can exploit this missing reference increment by utilizing an Apache map mechanism to overwrite existing map entries and free objects prematurely.

By carefully crafting an XML payload that causes a node to evaluate a stale object and immediately overwrite it with NULL, the pointer in the reference map becomes invalid. The attacker can then use the href attribute to point back to this stale memory.

By subsequently allocating plain strings to the freed memory, threat actors gain a high degree of control over the memory segment.

This deep level of memory manipulation creates a highly reliable pathway to Remote Code Execution, effectively bypassing standard memory protections.

Additional SOAP and PHP Core Vulnerabilities

In addition to the severe RCE flaw, researchers discovered CVE-2026-7261, a moderate-severity UAF vulnerability tied to the SoapServer session persistence feature. The SOAP_PERSISTENCE_SESSION flag allows developers to persist SOAP handler objects between requests in session storage.

However, the soap.c component fails to properly account for this flag when a handler function either returns false or throws a fatal exception.

This oversight causes the object to be freed but later incorrectly written to the session storage, resulting in a use-after-free scenario.

While it requires specific server configurations to be fully weaponised, it still poses a significant risk to applications that maintain complex session states.

Another SOAP-related flaw, CVE-2026-7262, involves a NULL pointer dereference in the Apache Map decoder. The to_zval_map() function properly checks for missing keys but fails to validate missing <value> nodes adequately.

If a typemap is configured on the target server, an attacker can embed an Apache:Map node with an intentionally missing value, causing the processing thread to crash. This creates a trivial vector for Denial-of-Service (DoS) attacks that require zero user interaction.

Beyond the SOAP extension, two out-of-bounds read vulnerabilities were identified in other PHP core functions. CVE-2026-7258 affects the standard urldecode() function.

Passing negative character values to the isxdigit() function without casting them to unsigned characters results in signed integer extension, triggering out-of-bounds memory reads on platforms such as NetBSD.

Furthermore, CVE-2026-6104 is a global buffer over-read in mb_convert_encoding(). When an attacker supplies an encoding name embedded with NUL bytes, the strncasecmp function terminates early, causing PHP to read past the intended buffer into adjacent global memory.

These memory corruption and logic vulnerabilities affect a wide footprint of current PHP releases. The issues are present in PHP versions before 8.2.31, 8.3.31, 8.4.21, and 8.5.6.

Any applications that rely on the SOAP extension or process untrusted inputs via URL decoding and multi-byte string conversion functions are potentially at risk of exploitation.

The PHP development team has successfully addressed these flaws in their latest releases by enforcing stricter memory safety checks. System administrators and web hosts, please upgrade your PHP installations to the patched versions: 8.2.31, 8.3.31, 8.4.21, or 8.5.6.

For the high-severity SOAP vulnerability, the remediation involved proactively increasing the object reference counts before adding them to the global reference map and configuring deallocators to release objects safely when the procedure completes.

The discovery and rapid remediation of these flaws highlight the collaborative effort across the open-source security research community.

Vulnerability reports were responsibly disclosed by researchers, including BrettGervasoni (CVE-2026-6722), iliaal (CVE-2026-7261 and CVE-2026-7262), xfourj (CVE-2026-7258), and AkshayJainG (CVE-2026-6104). The core remediation patches were developed by iluuu1994 with review support from ndossche.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.