# CVE-2026-6722: PHP SOAP extension use-after-free remote code execution

Source: https://junglewise.ai/threats/cve-2026-6722-php-soap-extension-use-after-free-remote-code-execution  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-10. Updated: 2026-06-30  
License: CC BY 4.0 with a link back

CVE-2026-6722 · Severity: critical · CVSS 9.8 · Published 2026-05-10

A critical vulnerability has been identified in the PHP SOAP extension, which is commonly used by web applications to exchange structured information. An attacker can exploit this flaw by sending a specially crafted SOAP request to a vulnerable server, potentially allowing them to take full control of the system. This could lead to the theft of sensitive customer data, complete service disruption, or a total compromise of the underlying server infrastructure.

Technologies: [PHP Group PHP](https://junglewise.ai/threats/technologies/php). Vendors: [PHP Group](https://junglewise.ai/threats/vendors/php-group).

## Quick answers

**Is CVE-2026-6722 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-6722 being exploited in the wild.

**How severe is CVE-2026-6722?** Critical severity, with a CVSS score of 9.8, published 10 May 2026.

**Which products and versions are affected?** PHP Group PHP 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, 8.5.* before 8.5.6.

**Is there a fix for CVE-2026-6722?** A patch was published on 2026-05-10: Fixes released in PHP 8.2.31, 8.3.31, 8.4.21, and 8.5.6 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-6722 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-6722?** Check whether you run PHP Group PHP at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A use-after-free (UAF) vulnerability exists in the PHP SOAP extension (ext-soap) due to improper reference counting in the object deduplication mechanism. When processing an 'apache:Map' node with duplicate keys, the extension overwrites entries in a temporary result map, freeing the original PHP object while maintaining a stale pointer in the global 'ref_map'. A subsequent 'href' reference to the freed node allows an attacker to copy this dangling pointer. By manipulating memory allocations (e.g., via PHP string allocations) to reclaim the freed region, a remote, unauthenticated attacker can achieve arbitrary code execution. The issue is resolved by ensuring reference counts are incremented before adding objects to the global map and using proper deallocators.

## Affected products

- PHP Group PHP 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, 8.5.* before 8.5.6
- Red Hat Red Hat Enterprise Linux 6
- Red Hat Red Hat Enterprise Linux 7
- Red Hat Red Hat Enterprise Linux 8
- Red Hat Red Hat Enterprise Linux 9
- Red Hat Red Hat Enterprise Linux 10

## Timeline

- 2026-05-07: advisory: PHP Group published security advisory GHSA-85c2-q967-79q5
- 2026-05-10: disclosed: CVE-2026-6722 published to NVD
- 2026-05-10: patched: Fixes released in PHP 8.2.31, 8.3.31, 8.4.21, and 8.5.6

## References

- [https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5](https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5)
- [https://access.redhat.com/security/cve/CVE-2026-6722](https://access.redhat.com/security/cve/CVE-2026-6722)
- [https://bugzilla.redhat.com/show_bug.cgi?id=2468560](https://bugzilla.redhat.com/show_bug.cgi?id=2468560)
- [https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-6722.json](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-6722.json)

## Related threats

- [PHP use-after-free in global state handling](https://junglewise.ai/threats/cve-2026-109619-php-has-various-global-state-that-temporarily-points-into)
- [PHP Memory Corruption Vulnerability](https://junglewise.ai/threats/cve-2026-109618-gcp-2026-070)
- [PHP Phar uncontrolled recursion in phar_get_link_source](https://junglewise.ai/threats/cve-2026-7260-php-phar-uncontrolled-recursion-in-phar-get-link-source)
- [PHP BCMath out-of-bounds write in bccomp](https://junglewise.ai/threats/cve-2026-17544-php-bcmath-out-of-bounds-write-in-bccomp)
- [PHP ext-pgsql SQL injection in pg_select and related functions](https://junglewise.ai/threats/cve-2026-17543-php-ext-pgsql-sql-injection-in-pg-select-and-related-functions)