CVE-2026-7262

Assessment

Why it matters

EPSS is 0.8%; technical severity is CVSS 2.9.

In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, when a SOAP server has a typemap configured, the decoding process contains a mistake which checks the wrong variable in case of missing value element.  This leads to dereferences a NULL pointer, causing a segmentation fault. This allows a remote unauthenticated attacker to crash the PHP SOAP server process, resulting in denial of service.

Who should care

• Teams operating PHP
• Vulnerability and exposure management teams
• Security operations teams monitoring exploitation activity

Response plan

What I would do

1. Confirm whether PHP is present in the environment.
2. Identify affected versions and establish whether vulnerable services are exposed or reachable.
3. Red Hat Security advisory RHSA-2026:22142
4. Review relevant security telemetry for evidence of attempted or successful exploitation.
5. Document the remediation decision and track it to verified completion.

Technical details

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:X/V:X/RE:M/U:Amber

CWE

CWE-476

Affected versions

PHP PHP (Start Including 8.2.0, End Excluding 8.2.31 | Start Including 8.3.0, End Excluding 8.3.31 | Start Including 8.4.0, End Excluding 8.4.21 | Start Including 8.5.0, End Excluding 8.5.6)

Fixed versions

PHP PHP (Fixed from 8.2.31, 8.3.31, 8.4.21, 8.5.6)

Published

10 May 2026

Attack vector

Network

Privileges required

None

User interaction

None

Signal timeline

1. 10 May 2026CVE published
2. 20 Aug 2026Latest EPSS score: 0.8%
3. 19 Aug 2026 · 13:52 UTCSignal calculated at 8

External references

• GitHub Technical reference GHSA Hmxp 6pc4 F3vv ↗