PatchSiren

PatchSiren cyber security CVE debrief

CVE-2016-10162 PHP CVE debrief

CVE-2016-10162 is a remotely triggerable denial-of-service issue in PHP's WDDX deserialization path. A crafted wddxPacket XML document with an inapplicable class name can cause mishandling in wddx_deserialize, leading to a NULL pointer dereference and application crash. NVD rates the issue CVSS 7.5 (High) because it is network-reachable, requires no privileges or user interaction, and impacts availability.

Vendor
PHP
Product
Unknown
CVSS
HIGH 7.5
CISA KEV
Not listed in stored evidence
Original CVE published
2017-01-24
Original CVE updated
2026-05-13
Advisory published
2017-01-24
Advisory updated
2026-05-13

Who should care

Operators and developers running PHP 7.0.0 through 7.0.14 or PHP 7.1.0, especially services that accept untrusted XML/WDDX input or call wddx_deserialize. Infrastructure teams should also care if a vendor package or distro build includes the affected PHP versions.

Technical summary

The flaw is in php_wddx_pop_element within ext/wddx/wddx.c. When deserializing a WDDX packet, an inapplicable class name can drive the parser into a bad state and dereference a NULL pointer, crashing the process. The NVD weakness mapping is CWE-476 (NULL Pointer Dereference). The published vulnerable range in the supplied record covers PHP 7.0.0-7.0.14 and 7.1.0, with fixes indicated by the vendor changelog and the referenced php-src patch.

Defensive priority

High

Recommended defensive actions

  • Upgrade PHP to a fixed release: 7.0.15, 7.1.1, or later.
  • Review application code for any use of wddx_deserialize or WDDX parsing on untrusted input.
  • If you cannot upgrade immediately, reduce exposure by removing or isolating WDDX handling paths that process external data.
  • Confirm whether your operating system vendor has backported the fix; the supplied record references RHSA-2018:1296.
  • Use the referenced PHP changelog, bug tracker entry, and php-src commit to verify the exact patched code path in your environment.

Evidence notes

The CVE description supplied in the corpus says the issue is a denial of service via NULL pointer dereference in php_wddx_pop_element, triggered by an inapplicable class name in a wddxPacket XML document and mishandling in a wddx_deserialize call. NVD metadata lists affected PHP versions 7.0.0-7.0.14 and 7.1.0, CVSS v3.0 vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, and CWE-476. The CVE was published on 2017-01-24; the 2026-05-13 modified timestamp reflects record updates, not the original vulnerability date.

Sources and references

Verified primary and authoritative sources

  • CVE-2016-10162 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2016-10162

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2016-10162 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2016-10162

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.