The SOAP HTTP client uses a signed integer overflow guard to limit response buffer growth. When the compiler optimizes away this check, a malicious SOAP server can cause the client to allocate a buffer that is far smaller than what it subsequently writes into, producing a heap buffer overflow that may allow arbitrary code execution in the PHP process.

PHP Group’s PHP implementation is affected. Older releases that have not applied the recent patch to correct the integer overflow guard in SOAP parsing are potentially vulnerable. The specific version range is not listed in this advisory, so any PHP release prior to the fix should be considered at risk.

The CVSS score of 6.5 reflects moderate severity. The EPSS score of < 1% indicates a low, but nonzero, exploitation probability, and the CVE is not listed in the CISA KEV catalog. The likely attack vector is a remote SOAP server that sends a crafted response to the PHP SOAP client over HTTP; the overflow could provide an attacker with full control of the PHP process.