CVE-2015-6832

7.3 highEPSS 5.0%

Use-after-free vulnerability in the SPL unserialize implementation in ext/spl/spl_array.c in PHP before 5.4.44, 5.5.x before 5.5.28, and 5.6.x before 5.6.12 allows remote attackers to execute arbitrary code via crafted serialized data that triggers misuse of an array field.

Severity

CVSS 3.0

7.3 high

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

EPSS: 5.0% chance of exploitation in the next 30 days; higher than 92% of CVEs (scores of 2026-10-31)
Published: 2016-01-19
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

php:php

References

http://www.debian.org/security/2015/dsa-3344
http://www.php.net/ChangeLog-5.php
https://bugs.php.net/bug.php?id=70068
https://security.gentoo.org/glsa/201606-10
http://www.debian.org/security/2015/dsa-3344

Check your stack JSON