CVE-2015-2787: Use-after-free vulnerability in the process_nested_data function in ext/standard/var_unserializer.re in PHP...

Security readout for executives and security teams

CVE-2015-2787 is a memory-safety flaw in PHP’s unserialize handling. If a vulnerable PHP application processes attacker-controlled serialized data, the flaw can lead to arbitrary code execution. The bundle does not provide CVSS, CWE, or evidence of active exploitation. Exposure is most likely in legacy PHP 5.4, 5.5, or 5.6 deployments below the fixed versions, especially applications accepting external serialized input. Vendor advisories indicate downstream operating system and platform packages may also have shipped affected PHP builds. Treat as high priority where legacy PHP remains in production. The business risk is strongest for internet-facing PHP applications that process serialized input. Modernized or fully patched PHP environments have materially lower exposure. Mitigation focus: Upgrade PHP to 5.4.39, 5.5.23, 5.6.7, or later supported vendor builds.; Apply relevant OS or vendor package updates from your distribution advisory channel.; Identify application paths that unserialize externally supplied data..

Prepared

Jun 14, 2026, 05:11 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.