diff --git a/NEWS b/NEWS
index 145660f8158..f08e4f431e2 100644
--- a/NEWS
+++ b/NEWS
@@ -26,6 +26,9 @@ PHP                                                                        NEWS
   . Fixed bug #68750 (PDOMysql with mysqlnd does not allow the usage of
     named pipes). (steffenb198@aol.com)
 
+- Phar:
+  . Fixed bug #68901 (use after free). (bugreports at internot dot info)
+
 - Sqlite3:
   . Fixed bug #68260 (SQLite3Result::fetchArray declares wrong 
     required_num_args). (Julien)
diff --git a/ext/phar/phar_object.c b/ext/phar/phar_object.c
index 3671054b816..712795b1a4f 100644
--- a/ext/phar/phar_object.c
+++ b/ext/phar/phar_object.c
@@ -2139,8 +2139,8 @@ static zval *phar_rename_archive(phar_archive_data *phar, char *ext, zend_bool c
 	}
 its_ok:
 	if (SUCCESS == php_stream_stat_path(newpath, &ssb)) {
-		efree(oldpath);
 		zend_throw_exception_ex(spl_ce_BadMethodCallException, 0 TSRMLS_CC, "phar \"%s\" exists and must be unlinked prior to conversion", newpath);
+		efree(oldpath);
 		return NULL;
 	}
 	if (!phar->is_data) {