diff --git a/NEWS b/NEWS
index 6d020762eee..5fdee5f1210 100644
--- a/NEWS
+++ b/NEWS
@@ -29,6 +29,10 @@ PHP                                                                        NEWS
 - Sockets:
   . Fix some potential crashes on incorrect argument value. (nielsdos)
 
+- Standard:
+  . Fixed OSS Fuzz #417078295 (Leak in failed unserialize() with opcache).
+    (ilutov)
+
 31 Jul 2025, PHP 8.3.24
 
 - Calendar:
diff --git a/ext/standard/tests/serialize/oss_fuzz_433303828.phpt b/ext/standard/tests/serialize/oss_fuzz_433303828.phpt
new file mode 100644
index 00000000000..fb90b51d4da
--- /dev/null
+++ b/ext/standard/tests/serialize/oss_fuzz_433303828.phpt
@@ -0,0 +1,13 @@
+--TEST--
+OSS-Fuzz #433303828
+--FILE--
+<?php
+
+unserialize('O:2:"yy": ');
+unserialize('O:2:"yy":: ');
+
+?>
+--EXPECTF--
+Warning: unserialize(): Error at offset 9 of 10 bytes in %s on line %d
+
+Warning: unserialize(): Error at offset 10 of 11 bytes in %s on line %d
diff --git a/ext/standard/var_unserializer.re b/ext/standard/var_unserializer.re
index a050fb5f74a..1d23269ef03 100644
--- a/ext/standard/var_unserializer.re
+++ b/ext/standard/var_unserializer.re
@@ -1310,10 +1310,12 @@ object ":" uiv ":" ["]	{
 	YYCURSOR = *p;
 
 	if (*(YYCURSOR) != ':') {
+		zend_string_release_ex(class_name, 0);
 		return 0;
 	}
 	if (*(YYCURSOR+1) != '{') {
 		*p = YYCURSOR+1;
+		zend_string_release_ex(class_name, 0);
 		return 0;
 	}