# CVE-2026-7261: PHP SoapServer use-after-free in SOAP_PERSISTENCE_SESSION

Source: https://junglewise.ai/threats/cve-2026-7261-php-soapserver-use-after-free-in-soap-persistence-session  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-10. Updated: 2026-07-24  
License: CC BY 4.0 with a link back

CVE-2026-7261 · Severity: critical · CVSS 9.8 · Published 2026-05-10

PHP is a widely used programming language for web development. A vulnerability in its SOAP (Simple Object Access Protocol) component could allow an attacker to cause system crashes, steal sensitive information, or potentially execute unauthorized code. This occurs when a web service is configured to remember user sessions and encounters a specific type of error during communication.

Technologies: [PHP Group PHP](https://junglewise.ai/threats/technologies/php). Vendors: [PHP Group](https://junglewise.ai/threats/vendors/php-group).

## Quick answers

**Is CVE-2026-7261 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-7261 being exploited in the wild.

**How severe is CVE-2026-7261?** Critical severity, with a CVSS score of 9.8, published 10 May 2026.

**Which products and versions are affected?** PHP Group PHP 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, 8.5.* before 8.5.6, 8.2.0 - 8.2.30, 8.3.0 - 8.3.30, 8.4.0 - 8.4.20, 8.5.0 - 8.5.5.

**Is there a fix for CVE-2026-7261?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-7261 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-7261?** Check whether you run PHP Group PHP at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A use-after-free vulnerability exists in PHP's SoapServer component (ext/soap) when SOAP_PERSISTENCE_SESSION is enabled. The root cause is a failure in soap.c to account for the persistence flag during error handling; specifically, when a handler function for a SOAP header node returns false or throws an exception, the handler object is prematurely freed while a pointer to it remains in session storage. When the session is subsequently written, the freed memory is accessed. This can be triggered by a remote, unauthenticated attacker sending a specially crafted SOAP request with a malicious header. The vulnerability can lead to memory corruption, process crashes, or information disclosure. Patches are available in PHP versions 8.2.31, 8.3.31, 8.4.21, and 8.5.6.

## Affected products

- PHP Group PHP 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, 8.5.* before 8.5.6

## Timeline

- 2026-05-07: advisory: Original GitHub advisory published by PHP Group
- 2026-05-10: disclosed: NVD publication date

## References

- [https://github.com/php/php-src/security/advisories/GHSA-m33r-qmcv-p97q](https://github.com/php/php-src/security/advisories/GHSA-m33r-qmcv-p97q)

## Related threats

- [PHP use-after-free in global state handling](https://junglewise.ai/threats/cve-2026-109619-php-has-various-global-state-that-temporarily-points-into)
- [PHP Memory Corruption Vulnerability](https://junglewise.ai/threats/cve-2026-109618-gcp-2026-070)
- [PHP Phar uncontrolled recursion in phar_get_link_source](https://junglewise.ai/threats/cve-2026-7260-php-phar-uncontrolled-recursion-in-phar-get-link-source)
- [PHP BCMath out-of-bounds write in bccomp](https://junglewise.ai/threats/cve-2026-17544-php-bcmath-out-of-bounds-write-in-bccomp)
- [PHP ext-pgsql SQL injection in pg_select and related functions](https://junglewise.ai/threats/cve-2026-17543-php-ext-pgsql-sql-injection-in-pg-select-and-related-functions)