CVE-2016-3141: Use-after-free vulnerability in wddx.c in the WDDX extension in PHP before 5.5.33 and 5.6.x before 5.6.19 a...

Security readout for executives and security teams

CVE-2016-3141 is a PHP WDDX parsing flaw. A crafted WDDX XML value can corrupt memory when processed, crashing the application and possibly causing other unspecified impact. The main business risk is legacy PHP services becoming unstable when they deserialize untrusted WDDX data. Exposure is most likely in legacy PHP 5.5 or 5.6 deployments with the WDDX extension enabled, especially applications that pass externally supplied XML or WDDX data into wddx_deserialize. Prioritize remediation for internet-facing or partner-facing legacy PHP systems that process XML-like inputs. For systems without WDDX enabled or without untrusted WDDX parsing, urgency is lower but still part of legacy PHP cleanup. Mitigation focus: Upgrade PHP to 5.5.33, 5.6.19, or a vendor-supported fixed package.; Apply relevant Ubuntu, SUSE, Red Hat, Apple, or Oracle security updates where applicable.; Disable the PHP WDDX extension if it is not required..

Prepared

Jun 13, 2026, 21:06 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.