A use-after-free vulnerability was discovered in unserialize() with SPL ArrayObject object’s deserialization that can be abused for leaking arbitrary memory blocks or execute arbitrary code remotely.