Threats tagged 'bit-php-2024-11235'

A use-after-free vulnerability exists in PHP versions 8.3 prior to 8.3.19 and 8.4 prior to 8.4.5. The flaw involves reference counting during php_request_shutdown and can be triggered by specific code sequences using the __set handler or the ??= operator combined with exceptions. Exploitation requires control over memory layout and may allow remote code execution. Red Hat has issued security updates addressing this vulnerability.