{"id":"CVE-2026-128016","aliases":[],"cve":{"records":[{"id":"CVE-2026-128016","source":"VulnCheck","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-11-12T20:32:53.532Z","published":"2026-11-13T09:34:10.667Z","modified":"2026-11-13T16:00:46.891Z"}],"publishers":[{"name":"VulnCheck","role":"CNA","organizationId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","modified":"2026-11-13T09:34:10.667Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-11-13T16:00:46.891Z"}],"references":[{"url":"https://github.com/php/frankenphp/security/advisories/GHSA-cm3q-jw2q-9rh5","tags":["vendor-advisory"],"source":"VulnCheck"},{"url":"https://github.com/php/frankenphp/commit/837b76880b33a1a78ae4f27dea85bdcddb6cf70c","tags":["patch"],"source":"VulnCheck"},{"url":"https://www.vulncheck.com/advisories/frankenphp-before-1.13.4-use-after-free-of-spltempfileobject-streams-in-worker-mode","tags":["third-party-advisory"],"source":"VulnCheck"}],"weaknesses":[{"id":"CWE-416","description":"Use After Free","source":"VulnCheck"}],"applicability":[{"source":"VulnCheck","statements":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:php:frankenphp:*:*:*:*:*:*:*:*","versionEndExcluding":"1.13.4"}]}]}]}],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-11-13T15:29:29.060551Z","decisions":[{"name":"Exploitation","value":"none"},{"name":"Automatable","value":"no"},{"name":"Technical Impact","value":"partial"}]}]},"title":"FrankenPHP before 1.13.4 Use-After-Free of SplTempFileObject Streams in Worker Mode","titleSource":"VulnCheck","descriptionSource":"VulnCheck","description":"FrankenPHP before 1.13.4 contains a use-after-free vulnerability in worker mode that frees internal streams of SplTempFileObject or SplFileObject on php://temp instances surviving across requests. Remote clients can send requests reaching code that uses such persisted objects, causing reads of freed memory that leak garbage data or crash the process.","score":8.3,"severity":"high","published":"2026-11-13T09:34:10.667Z","modified":"2026-11-13T16:00:46.891Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"php","name":"frankenphp","platforms":[],"versions":[{"version":"0","status":"affected","lessThan":"1.13.4","versionType":"semver"},{"version":"1.13.4","status":"unaffected","versionType":"semver"}],"defaultStatus":"unaffected","packageURL":"pkg:golang/github.com/dunglas/frankenphp","packageIdentity":{"ecosystem":"Go","name":"github.com/dunglas/frankenphp"},"cpes":[],"source":"VulnCheck","url":"https://www.cve.org/CVERecord?id=CVE-2026-128016"}],"remediation":[],"references":["https://github.com/php/frankenphp/security/advisories/GHSA-cm3q-jw2q-9rh5","https://github.com/php/frankenphp/commit/837b76880b33a1a78ae4f27dea85bdcddb6cf70c","https://www.vulncheck.com/advisories/frankenphp-before-1.13.4-use-after-free-of-spltempfileobject-streams-in-worker-mode"],"sources":[{"name":"CVE","id":"CVE-2026-128016","modified":"2026-11-13T16:00:46.891Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-128016"}],"assessments":[{"source":"VulnCheck","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N","score":8.3},{"source":"VulnCheck","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H","score":6.5}],"sourceAffected":[],"observedAt":"2026-11-13T17:57:04.900Z","kev":{"status":"not-listed","checkedAt":"2026-11-15T02:25:31.038Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-11-13T18:30:55.911Z","attemptedAt":"2026-11-13T18:30:55.911Z"},{"source":"GHSA","status":"available","checkedAt":"2026-11-13T18:30:32.844Z","attemptedAt":"2026-11-13T18:30:32.844Z"},{"source":"EUVD","status":"available","checkedAt":"2026-11-13T18:30:32.337Z","attemptedAt":"2026-11-13T18:30:32.337Z"},{"source":"EPSS","status":"available","checkedAt":"2026-11-13T18:30:32.196Z","attemptedAt":"2026-11-13T18:30:32.196Z"}],"evidence":[{"source":"FIRST EPSS","id":"CVE-2026-128016","url":"https://www.first.org/epss/","probability":0.00453,"percentile":0.39865,"date":"2026-11-13","checkedAt":"2026-11-13T18:30:32.196Z"},{"source":"ENISA EUVD","id":"EUVD-2026-125086","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-125086","modified":"Nov 13, 2026, 4:00:46 PM","score":8.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N","checkedAt":"2026-11-13T18:30:32.337Z"},{"source":"GitHub Advisory Database","id":"GHSA-f45r-jvx9-jfvx","url":"https://github.com/advisories/GHSA-f45r-jvx9-jfvx","modified":"2026-11-13T12:31:36Z","score":6.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H","checkedAt":"2026-11-13T18:30:32.844Z"},{"source":"NVD","id":"CVE-2026-128016","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-128016","modified":"2026-11-13T16:18:55.567","score":8.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","checkedAt":"2026-11-13T18:30:55.911Z"},{"source":"NVD","id":"CVE-2026-128016","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-128016","modified":"2026-11-13T16:18:55.567","score":6.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H","checkedAt":"2026-11-13T18:30:55.911Z"}],"aiSummary":{"text":"FrankenPHP before 1.13.4 has a use-after-free vulnerability in worker mode, where internal streams of SplTempFileObject or SplFileObject are freed but still used, potentially causing crashes or data leaks. Remote clients can send requests to trigger this issue. The vulnerability affects versions before 1.13.4.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-11-13T13:56:10.459Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-128016"}]}}