CVE-2016-10162: The php_wddx_pop_element function in ext/wddx/wddx.c in PHP 7.0.x before 7.0.15 and 7.1.x before 7.1.1 allo...

Security readout for executives and security teams

This flaw affects legacy PHP 7 WDDX deserialization. A crafted WDDX XML document can crash the PHP application process, causing denial of service rather than data theft or code execution based on the supplied sources. Exposure is likely limited to applications running affected PHP 7.0 or 7.1 versions that deserialize attacker-controlled WDDX XML. Systems not using WDDX deserialization are less likely to be reachable through this issue. Treat as a legacy-platform stability risk. Prioritize if affected PHP versions process external XML or support business-critical services. It is lower urgency than confirmed code execution but should not remain unresolved on exposed systems. Mitigation focus: Upgrade PHP to 7.0.15, 7.1.1, or a later supported fixed release.; Use distribution vendor packages and advisories, including Red Hat guidance where applicable.; Review whether WDDX is required and remove unused exposure where operationally safe..

Prepared

Jun 13, 2026, 12:51 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.