CVE-2016-7131: ext/wddx/wddx.c in PHP before 5.6.25 and 7.x before 7.0.10 allows remote attackers to cause a denial of ser...

Security readout for executives and security teams

This flaw affects PHP applications that deserialize WDDX XML. A malformed WDDX packet can crash the application process, creating a remote denial-of-service risk. The source record also says unspecified other impact is possible, but does not define it. No provided source indicates known active exploitation. Exposure is most likely where legacy PHP applications accept attacker-controlled WDDX XML and pass it to wddx_deserialize. Systems not using WDDX deserialization are less likely exposed, based on the provided description. Treat as a targeted legacy PHP remediation item. Prioritize internet-facing or partner-facing systems that parse WDDX XML, because successful abuse can crash application processes and affect availability. Mitigation focus: Upgrade PHP to 5.6.25, 7.0.10, or vendor-fixed packages referenced by advisories.; Identify and reduce WDDX deserialization of untrusted XML inputs.; Apply relevant distribution advisories from Red Hat, Gentoo, or other PHP package maintainers..

Prepared

Jun 13, 2026, 13:39 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.