Critical severity9.8NVD Advisory· Published Sep 17, 2016· Updated May 6, 2026
CVE-2016-7411
CVE-2016-7411
Description
ext/standard/var_unserializer.re in PHP before 5.6.26 mishandles object-deserialization failures, which allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via an unserialize call that references a partially constructed object.
Affected products
1Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
7- github.com/php/php-src/commit/6a7cc8ff85827fa9ac715b3a83c2d9147f33cd43nvdIssue TrackingPatch
- bugs.php.net/bug.phpnvdExploitIssue Tracking
- www.openwall.com/lists/oss-security/2016/09/15/10nvdMailing List
- www.php.net/ChangeLog-5.phpnvdRelease Notes
- www.securityfocus.com/bid/93009nvd
- www.securitytracker.com/id/1036836nvd
- security.gentoo.org/glsa/201611-22nvd
News mentions
0No linked articles in our index yet.