The vulnerability is a use‑after‑free flaw in PHP's SOAP extension that occurs during object deduplication with duplicate keys in an apache:Map node. The flaw allows an attacker to free a PHP object, leave a dangling pointer in the global map, and later reference that freed memory to overwrite it with arbitrary data, yielding remote code execution. The weakness is a classic use‑after‑free, classified as CWE‑416.

PHP Group's PHP releases 8.2, 8.3, 8.4, and 8.5 are affected. Versions prior to 8.2.31, 8.3.31, 8.4.21, and 8.5.6 respectively are vulnerable. The vulnerability resides in the SOAP extension, which is enabled by default in most PHP deployments.

The flaw carries a CVSS score of 9.5, indicating a critical severity. No EPSS score is available, but the exploit requires remote access through a crafted SOAP request containing duplicate keys, a scenario that is feasible for attackers who can send arbitrary SOAP messages. The vulnerability is not listed in CISA's KEV catalog yet, but the high severity and remote exploitation potential warrant urgent attention. An attacker with control over the SOAP body can trigger the use‑after‑free, leading to arbitrary code execution on the affected host.