CVE-2016-7126

CVE-2016-7126 is a critical denial-of-service vulnerability affecting PHP versions before 5.6.25 and 7.x before 7.0.10. It stems from improper validation in the imagetruecolortopalette function, allowing remote attackers to trigger an out-of-bounds write and potentially other impacts through a large third argument. With a CVSS score of 9.8, this vulnerability is easily exploitable over the network with low complexity and no user interaction, leading to high impacts on confidentiality, integrity, and availability. Despite its severity, there is no known active exploitation, publicly available exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage.