PHP manages a global state that temporarily points into request memory; when this state is not correctly reset or is re‑initialized after being cleared, it may still reference memory that has been freed. An attacker can send specially crafted requests that trigger this stale memory condition, leading the interpreter to read or jump to unwanted locations and ultimately execute arbitrary code. The vulnerability is characterized by several memory‑management weaknesses, reflected in CWEs such as malformed pointer use, improper memory initialization, and use‑after‑free.

The product affected is PHP, maintained by the PHP Group. All PHP installations that rely on the vulnerable global‑state mechanism are potentially at risk until a patch is applied, as no specific version range is indicated in the advisory.

The CVSS score of 9.2 indicates a critical remote code execution risk that threatens confidentiality, integrity, and availability of affected systems. The EPSS score is 100%, and the vulnerability is listed in KEV, highlighting the severity and the potential for exploitation. Based on the description, it is inferred that an attacker can exploit the flaw by sending crafted requests over the network without requiring prior authentication, causing the interpreter to act on stale global state and execute code arbitrarily.