This vulnerability involves a use-after-free condition in the PHP SOAP extension's object deduplication mechanism. Specifically, when processing an apache:Map node with duplicate keys, the second entry overwrites the first in a temporary result map, freeing the original PHP object but leaving a stale pointer. Subsequent href references can copy this dangling pointer, and because PHP string allocations may reuse the freed memory, an attacker can exploit this to execute arbitrary code remotely. Affected PHP versions include 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6. The vulnerability is tracked as CWE-416 (Use After Free) and carries a CVSS 4.0 score of 9.5, reflecting its critical impact.

Successful exploitation allows remote code execution by an attacker who can control the SOAP request body. This can lead to full compromise of the affected PHP environment. The vulnerability affects multiple recent PHP versions, increasing the potential attack surface. No known exploits in the wild have been reported at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or remediation level is provided, users should monitor PHP Group advisories closely. Until a fix is available, consider disabling the SOAP extension if it is not required or applying other environment-specific mitigations to limit exposure to untrusted SOAP requests.