This vulnerability involves a use-after-free condition in PHP's SoapServer when using SOAP_PERSISTENCE_SESSION. Specifically, if a SOAP request results in an error, the persistence mechanism incorrectly frees the handler object but keeps a pointer referencing it. This can cause memory corruption, potentially leading to information disclosure or crashes affecting system stability. The issue affects multiple PHP versions prior to 8.2.31, 8.3.31, 8.4.21, and 8.5.6. The vulnerability is tracked as CWE-416 and has a CVSS 4.0 score of 6.3. There is no vendor advisory indicating an official fix or mitigation at this time.

Successful exploitation may lead to memory corruption, which can cause information disclosure, process crashes, and compromise the confidentiality, integrity, and availability of the affected PHP environment. The impact is rated medium severity based on the CVSS score of 6.3. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider avoiding the use of SOAP_PERSISTENCE_SESSION in SoapServer configurations or implement additional safeguards to limit exposure. Monitor vendor channels for updates and apply patches promptly once available.