diff --git a/NEWS b/NEWS
index 84f7de878cd58..2a13afcba95ae 100644
--- a/NEWS
+++ b/NEWS
@@ -16,6 +16,8 @@ PHP                                                                        NEWS
   . Fixed memory management of Uri\WhatWg\Url objects. (timwolla)
   . Fixed memory management of the internal "parse_url" URI parser.
     (timwolla)
+  . Fixed double-free when assigning to $errors fails when using
+    the Uri\WhatWg\Url parser. (timwolla)
   . Clean up naming of internal API. (timwolla)
 
 28 Aug 2025, PHP 8.5.0beta2
diff --git a/ext/uri/php_uri.c b/ext/uri/php_uri.c
index abdaa3eebe958..8f7dd2078e8ae 100644
--- a/ext/uri/php_uri.c
+++ b/ext/uri/php_uri.c
@@ -325,7 +325,6 @@ static zend_result pass_errors_by_ref_and_free(zval *errors_zv, zval *errors)
 
 	ZEND_TRY_ASSIGN_REF_ARR(errors_zv, Z_ARRVAL_P(errors));
 	if (EG(exception)) {
-		zval_ptr_dtor(errors);
 		return FAILURE;
 	}
 
@@ -360,6 +359,7 @@ ZEND_ATTRIBUTE_NONNULL_ARGS(1, 2) PHPAPI void php_uri_instantiate_uri(
 	}
 
 	if (pass_errors_by_ref_and_free(errors_zv, &errors) == FAILURE) {
+		uri_parser->free_uri(uri);
 		RETURN_THROWS();
 	}
 
diff --git a/ext/uri/tests/057.phpt b/ext/uri/tests/057.phpt
new file mode 100644
index 0000000000000..e2a109ccdacb9
--- /dev/null
+++ b/ext/uri/tests/057.phpt
@@ -0,0 +1,21 @@
+--TEST--
+Test assigning errors by reference fails
+--EXTENSIONS--
+uri
+--FILE--
+<?php
+
+class Foo {
+	public string $x = '';
+}
+
+$f = new Foo();
+try {
+    Uri\WhatWg\Url::parse(" https://example.org ", errors: $f->x);
+} catch (Throwable $e) {
+    echo $e::class, ": ", $e->getMessage(), PHP_EOL;
+} 
+
+?>
+--EXPECT--
+TypeError: Cannot assign array to reference held by property Foo::$x of type string