Uninitialized Pointer Dereference in PHP

UNKNOWN No Patch (2837 days)

Threat Intelligence

Low Risk
🔍 Detection Tools: None available in major open-source tools
⚔️ Exploit Availability: No public exploits found

How we test →

What is it?

PHP is a server-side scripting language used for web development. This vulnerability allows attackers to execute arbitrary code on your server by manipulating uninitialized pointers in PHP's Zend Engine.

Am I affected?

You're affected if you use PHP versions 7.2.13, 7.3.10, and 7.4.9.
Check with: grep -r 'zend_op_array' /usr/lib/php/ (for Linux) or grep -r 'zend_op_array' C:\php\ (for Windows)

Affected Products

PHP Group / PHP

How to fix

Upgrade to PHP 8.0.1 or later from the official website (https://www.php.net/downloads/).
- Alternatively, apply the patch manually using the provided PHP source code.