CVE-2016-7133: Zend/zend_alloc.c in PHP 7.x before 7.0.10, when open_basedir is enabled, mishandles huge realloc operation...

Security readout for executives and security teams

This is an old PHP 7 memory-handling flaw that can crash affected PHP processes when open_basedir is enabled and a long pathname is processed. The documented business risk is service disruption. Sources also mention possible unspecified impact, but they do not define it. Exposure is most likely in legacy environments still running PHP 7.x before 7.0.10 with open_basedir enabled and application paths influenced by remote input. Current supported PHP deployments should not normally be affected if patched beyond the vulnerable release line. Treat this as a legacy exposure cleanup item unless vulnerable PHP 7.0-era systems are internet-facing. Escalate priority if business-critical applications still run PHP before 7.0.10 with open_basedir enabled. Mitigation focus: Upgrade PHP 7.x deployments to 7.0.10 or a vendor-supported patched release.; Check applicable distribution advisories, including Gentoo GLSA-201611-22.; Prioritize systems where open_basedir is enabled..

Prepared

Jun 13, 2026, 13:39 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.