CVE-2007-1286

CVE-2007-1286 is an integer overflow vulnerability affecting PHP 4.4.4 and earlier versions. It allows remote attackers to execute arbitrary code by supplying a crafted long string to the unserialize function, which triggers an overflow in the ZVAL reference counter. The vulnerability has a CVSS score of 6.8, indicating a medium severity, and can be exploited remotely with medium attack complexity, potentially leading to partial confidentiality, integrity, and availability compromise. While not listed on CISA's KEV catalog, exploit code is publicly available, including Metasploit modules and ExploitDB entries, though there is no evidence of active exploitation or significant community discussion.