VIR Vulnerability Intelligence Relay

CVE-2015-8876

critical
Published 2016-05-22 · Modified 2026-05-06
CVSS v3
9.8
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v2
7.5
VIR risk
9.8

Description

Zend/zend_exceptions.c in PHP before 5.4.44, 5.5.x before 5.5.28, and 5.6.x before 5.6.12 does not validate certain Exception objects, which allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) or trigger unintended method execution via crafted serialized data.

Predictions

Exploit likelihood
97%
Patch ETA
—

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

vendor Authored 2026-05-27

Vendor advisory: cve@mitre.org — https://bugs.php.net/bug.php?id=70121

vendor Authored 2026-05-27

Vendor advisory: cve@mitre.org — http://www.php.net/ChangeLog-5.php

Application impact
VendorProductVersionsFixed
php phpphp{"startIncluding":"5.4.0","endExcluding":"5.4.44"}5.4.44

References

Verify integrity in audit chain (admin only). AS-IS.