Skip to content
CVE Tracker
Back

CVE-2016-7479

In all versions of PHP 7, during the unserialization process, resizing the 'properties' hash table of a serialized object may lead to…

Critical9.8EPSS 41.7%
Published
Updated
Reserved
Assigned by
checkpoint

Description

In all versions of PHP 7, during the unserialization process, resizing the 'properties' hash table of a serialized object may lead to use-after-free. A remote attacker may exploit this bug to gain arbitrary code execution.

Scores

CVSS scores of CVE-2016-7479, by who scored it
Scored byCVSSScoreVector
NVDNVD · Modified3.0Critical9.8CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS (exploitation in 30 days)
41.7% · top 1.3% of all CVEs (2 Nov 2026)

Loading the EPSS history…

The list uses the assigner's score when there is one, then CISA's, then NVD's: Critical 9.8.

Weakness

Affected products

  • PHP 7.x

    • affected PHP 7.x

References (8)

Sources

The same CVE in the primary databases and aggregators, to check against.

Record last updated .