This vulnerability (CVE-2026-6722) involves a use-after-free condition in the PHP SOAP extension's object deduplication mechanism. Specifically, the mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When duplicate keys exist in an apache:Map node, the second entry overwrites the first in the temporary result map, freeing the original PHP object but leaving a stale pointer. Subsequent references to the freed node can copy the dangling pointer into the result, and since PHP string allocations may reclaim the freed memory, this can lead to remote code execution. The vulnerability affects PHP versions 8.2.* prior to 8.2.31, 8.3.* prior to 8.3.31, 8.4.* prior to 8.4.21, and 8.5.* prior to 8.5.6. Red Hat has issued security advisories and updates for their PHP packages to address this issue.

Successful exploitation of this use-after-free vulnerability allows an attacker who can control the SOAP request body to execute arbitrary code remotely. This poses a critical security risk as it can lead to full system compromise without requiring authentication or user interaction. The CVSS 4.0 base score is 9.5, reflecting the high severity and potential impact on confidentiality, integrity, and availability.

Red Hat has released updated PHP packages that fix this vulnerability. Users of affected Red Hat Enterprise Linux versions should apply the security updates provided in RHSA-2026:23388 or later. Since this is not a cloud service, remediation requires applying the vendor-supplied patches. Patch status is confirmed by the Red Hat advisory. No alternative mitigations are specified in the advisory; applying the official update is the recommended action.