CVE-2024-11235

A flaw was found in PHP. This vulnerability allows remote code execution via a crafted code path involving the __set magic method or the null coalescing assignment (??=) operator, in combination with exception handling. Attackers can trigger a use-after-free condition by controlling the memory layout through specially crafted inputs.

This vulnerability marked as Important instead of Moderate because it leads to a use-after-free condition, allowing attackers to exploit PHP’s memory management for remote code execution. Unlike moderate flaws that might cause limited disruption, this issue arises from a dangerous interaction between the __set method or the ??= operator and exceptions, leading to freed memory being accessed unpredictably. If an attacker can control the memory layout through crafted inputs, they can hijack execution flow, making this a severe risk in real-world PHP applications.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.