This vulnerability arises from an error in the PHP SOAP server implementation when a typemap is configured. Specifically, during the decoding process, the code checks the wrong variable if a value element is missing, causing a NULL pointer dereference and a segmentation fault. A remote attacker can exploit this by sending crafted requests to crash the PHP SOAP server process, causing denial of service. The affected PHP versions are 8.2.*, 8.3.*, 8.4.*, and 8.5.* prior to the specified patch levels. The CVSS 4.0 base score is 2.9, indicating low severity. No vendor advisory or patch links are currently provided, and the remediation level is unknown.

The impact is limited to denial of service via a segmentation fault in the PHP SOAP server process. There is no indication of remote code execution, data leakage, or privilege escalation. The vulnerability can be triggered by a remote unauthenticated attacker, potentially causing service disruption for applications relying on PHP SOAP servers with typemaps configured.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider disabling or restricting access to the PHP SOAP server functionality if feasible to reduce exposure. Monitor for updates from the PHP Group regarding patches or workarounds.