CVE-2026-109618
RCE via OOM corruption
At a glance Severity CRITICAL 9.2 Exploitation Known exploited (CISA KEV) · added 2026-10-26 Exploited per ENISA since 2026-10-26 EPSS EPSS 100.00 % · percentile 100 (2026-10-27) State PUBLISHED Published 2026-10-21 Updated 2026-10-28 Assigner php NVD status Analyzed Description PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE).
Scores Version Score Vector Scored by CVSS 4.0 CRITICAL 9.2 CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N php CVSS 4.0 CRITICAL 9.2 CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X NVD · security@php.net (Secondary) CVSS 3.1 CRITICAL 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H NVD · nvd@nist.gov (Primary)
Weaknesses (CWE)
European references
CERT-FR advisories
Affected configurations (NVD CPE) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* ≥ 7.3.0 < 8.2.35cpe:2.3:a:php:php:*:*:*:*:*:*:*:* ≥ 8.3.0 < 8.3.36cpe:2.3:a:php:php:*:*:*:*:*:*:*:* ≥ 8.4.0 < 8.4.27cpe:2.3:a:php:php:*:*:*:*:*:*:*:* ≥ 8.5.0 < 8.5.12cpe:2.3:o:siemens:ruggedcom_ape1808_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:*:*:*:*:*:*:*:* ≥ 10.2.0 < 10.2.7cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:-:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h1:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h10:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h11:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h12:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h13:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h14:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h15:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h16:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h17:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h18:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h19:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h2:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h20:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h21:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h22:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h23:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h24:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h3:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h32:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h34:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h35:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h36:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h37:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h38:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h4:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h5:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h6:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h7:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h8:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h9:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:10.2.8:*:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:10.2.9:*:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:-:*:*:*:*:*:*+258 more Affected products Product Versions PHP Group · PHP affected 8.2.* < 8.2.35 ; affected 8.3.* < 8.3.36 ; affected 8.4.* < 8.4.27 ; affected 8.5.* < 8.5.12
References
Sources
