From my understanding, the vulnerability is a use-after-free, i.e. PHP allocates memory, stores pointer to it, frees it, maybe re-uses the memory for something new and then accesses the pointer. So totally exploitable.
Note that use-after-free would be prevented in memory-safe languages such as Java, Go or Rust.
Note that use-after-free would be prevented in memory-safe languages such as Java, Go or Rust.