CVE-2015-2787

CVE-2015-2787 is a use-after-free vulnerability in PHP's unserialization process, affecting PHP versions before 5.4.39, 5.5.23, and 5.6.7, as well as products like Apple, openSUSE, and Red Hat that utilize these PHP versions. This flaw allows remote attackers to execute arbitrary code through a specially crafted unserialize call that leverages the unset function within a __wakeup function. With a CVSS score of 7.5, it is considered highly severe, requiring no authentication and having low attack complexity, potentially leading to full compromise of confidentiality, integrity, and availability. Despite its high severity and EPSS score, there is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage.