That post appears to show the same stack trace as this reported issue https://github.com/php/php-src/issues/24488, which is a confirmed GC regression in 8.5.12 but it is not exploitable (the allocator's shadow protection kills it), and it does not result in RCE and is not a critical CVE.

It's a very different shape to the other two CVEs, and a use-after-free doesn't necessarily immediately imply a critical CVE.

▲

athrowaway3z 2 hours ago | parent [-]

Stop posting this theory because it's obviously wrong. From the thread:

> Elise: confirmed working on 8.5.10 too

▲

nr378 2 hours ago | parent [-]

Whether it's exactly the same issue or not, the point remains: a double-free in and of itself doesn't establish a critical CVE (or even a high one). There's a known double-free in that GitHub issue, if there's a second independent one, it shouldn't necessarily cause any more concern than the first one.

▲

athrowaway3z 2 hours ago | parent [-]

Its nothing

https://www.reddit.com/r/PHP/comments/1xbyxd2/new_php_cve_di...

	▲	akersten 2 hours ago \| parent [-]
		Color me unconvinced that the dev team that sat on the 2024 security audit leading to today's CVE successfully explored the ramifications of a new memory bug in an hour