diff --git a/NEWS b/NEWS
index 28a8f2b0d7d..02436428b92 100644
--- a/NEWS
+++ b/NEWS
@@ -33,6 +33,8 @@ PHP                                                                        NEWS
   . Fix a bunch of memory leaks in phar_parse_zipfile() error handling.
     (nielsdos)
   . Fix file descriptor/memory leak when opening central fp fails. (nielsdos)
+  . Fix memleak+UAF when opening temp stream in buildFromDirectory() fails.
+    (nielsdos)
 
 - Random:
   . Fix Randomizer::__serialize() w.r.t. INDIRECTs. (nielsdos)
diff --git a/ext/phar/phar_object.c b/ext/phar/phar_object.c
index 5970a9e5630..483a5dcd575 100644
--- a/ext/phar/phar_object.c
+++ b/ext/phar/phar_object.c
@@ -1792,6 +1792,10 @@ PHP_METHOD(Phar, buildFromDirectory)
 	pass.ret = return_value;
 	pass.fp = php_stream_fopen_tmpfile();
 	if (pass.fp == NULL) {
+		zval_ptr_dtor(&iteriter);
+		if (apply_reg) {
+			zval_ptr_dtor(&regexiter);
+		}
 		zend_throw_exception_ex(phar_ce_PharException, 0, "phar \"%s\" unable to create temporary file", phar_obj->archive->fname);
 		RETURN_THROWS();
 	}