Description
The unserialize implementation in ext/standard/var.c in PHP 7.x before 7.0.14 allows remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via crafted serialized data. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-6834.
Remediation
References
Related Vulnerabilities
WordPress 4.6.x Arbitrary File Deletion Vulnerability (4.6 - 4.6.11)
Craft CMS Incorrect Authorization Vulnerability (CVE-2026-32267)
WordPress Plugin wSecure Lite Remote Code Execution (2.3)
MOVEit Transfer Incorrect Authorization Vulnerability (CVE-2026-8800)
Plone CMS Permissions, Privileges, and Access Controls Vulnerability (CVE-2015-7317)