CVE-2015-0231

CVE-2015-0231 is a use-after-free vulnerability in PHP versions prior to 5.4.37, 5.5.21, and 5.6.5, specifically within the process_nested_data function. This flaw allows remote attackers to execute arbitrary code by crafting a malicious unserialize call that exploits improper handling of duplicate numerical keys in serialized object properties. With a CVSS score of 7.5, this vulnerability is highly severe, requiring no authentication and having low attack complexity, potentially leading to partial confidentiality, integrity, and availability compromise. While there is no known active exploitation or public exploit code (Metasploit, Nuclei, ExploitDB), its high EPSS score and community discussion indicate significant potential for future exploitation.