{"api_version":"1","generated_at":"2026-10-21T18:43:05+00:00","cve":"CVE-2026-109618","urls":{"html":"https://cve.report/CVE-2026-109618","api":"https://cve.report/api/cve/CVE-2026-109618.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-109618","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-109618"},"summary":{"title":"RCE via OOM corruption","description":"PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE).","state":"PUBLISHED","assigner":"php","published_at":"2026-10-21 14:17:09","updated_at":"2026-10-21 17:18:24"},"problem_types":["CWE-416","CWE-755","CWE-824","CWE-1325","CWE-416 CWE-416 Use after free","CWE-755 CWE-755 Improper Handling of Exceptional Conditions","CWE-824 CWE-824 Access of uninitialized pointer","CWE-1325 CWE-1325 Improperly controlled sequential memory allocation","CWE-1419 CWE-1419 Incorrect Initialization of Resource"],"metrics":[{"version":"4.0","source":"security@php.net","type":"Secondary","score":"9.2","severity":"CRITICAL","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","data":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":9.2,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"HIGH","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}},{"version":"4.0","source":"CNA","type":"CVSS","score":"9.2","severity":"CRITICAL","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","data":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"NETWORK","baseScore":9.2,"baseSeverity":"CRITICAL","exploitMaturity":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"}},{"version":"3.1","source":"nvd@nist.gov","type":"Primary","score":"9.8","severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"}}],"references":[{"url":"https://www.wiz.io/blog/php2shell-php-rce","name":"https://www.wiz.io/blog/php2shell-php-rce","refsource":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["Third Party Advisory"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w","name":"https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w","refsource":"security@php.net","tags":["Mitigation","Vendor Advisory"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"http://www.openwall.com/lists/oss-security/2026/10/21/6","name":"http://www.openwall.com/lists/oss-security/2026/10/21/6","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-109618","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109618","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"PHP Group","product":"PHP","version":"affected 8.2.* 8.2.35 semver","platforms":[]},{"source":"CNA","vendor":"PHP Group","product":"PHP","version":"affected 8.3.* 8.3.36 semver","platforms":[]},{"source":"CNA","vendor":"PHP Group","product":"PHP","version":"affected 8.4.* 8.4.27 semver","platforms":[]},{"source":"CNA","vendor":"PHP Group","product":"PHP","version":"affected 8.5.* 8.5.12 semver","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[{"source":"CNA","title":"","value":"Check the GitHub Security Advisory for mitigation strategies.","time":"","lang":"en"}],"exploits":[],"credits":[{"source":"CNA","value":"Ryan at Calif.io","lang":"en"},{"source":"CNA","value":"Wiz","lang":"en"},{"source":"CNA","value":"OpenAI","lang":"en"},{"source":"CNA","value":"Arnaud Le Blanc","lang":"en"},{"source":"CNA","value":"Ilija Tovilo","lang":"en"},{"source":"CNA","value":"Jakub Zelenka","lang":"en"},{"source":"CNA","value":"Nora Dossche","lang":"en"}],"nvd_cpes":[{"cve_year":"2026","cve_id":"109618","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"php","cpe5":"php","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"metrics":[{"other":{"content":{"id":"CVE-2026-109618","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-21T14:34:39.479770Z","version":"2.0.3"},"type":"ssvc"}}],"providerMetadata":{"dateUpdated":"2026-10-21T14:36:24.229Z","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP"},"references":[{"tags":["third-party-advisory"],"url":"https://www.wiz.io/blog/php2shell-php-rce"}],"title":"CISA ADP Vulnrichment"},{"providerMetadata":{"dateUpdated":"2026-10-21T16:07:52.535Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"url":"http://www.openwall.com/lists/oss-security/2026/10/21/6"}],"title":"CVE Program Container"}],"cna":{"affected":[{"defaultStatus":"unaffected","packageName":"php-src","product":"PHP","vendor":"PHP Group","versions":[{"lessThan":"8.2.35","status":"affected","version":"8.2.*","versionType":"semver"},{"lessThan":"8.3.36","status":"affected","version":"8.3.*","versionType":"semver"},{"lessThan":"8.4.27","status":"affected","version":"8.4.*","versionType":"semver"},{"lessThan":"8.5.12","status":"affected","version":"8.5.*","versionType":"semver"}]}],"credits":[{"lang":"en","type":"reporter","value":"Ryan at Calif.io"},{"lang":"en","type":"reporter","value":"Wiz"},{"lang":"en","type":"finder","value":"OpenAI"},{"lang":"en","type":"remediation developer","value":"Arnaud Le Blanc"},{"lang":"en","type":"remediation developer","value":"Ilija Tovilo"},{"lang":"en","type":"remediation developer","value":"Jakub Zelenka"},{"lang":"en","type":"remediation developer","value":"Nora Dossche"}],"descriptions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE).<br>"}],"value":"PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE)."}],"impacts":[{"capecId":"CAPEC-234","descriptions":[{"lang":"en","value":"CAPEC-234 Hijacking a privileged process"}]}],"metrics":[{"cvssV4_0":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"NETWORK","baseScore":9.2,"baseSeverity":"CRITICAL","exploitMaturity":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-416","description":"CWE-416 Use after free","lang":"en","type":"CWE"}]},{"descriptions":[{"cweId":"CWE-755","description":"CWE-755 Improper Handling of Exceptional Conditions","lang":"en","type":"CWE"}]},{"descriptions":[{"cweId":"CWE-824","description":"CWE-824 Access of uninitialized pointer","lang":"en","type":"CWE"}]},{"descriptions":[{"cweId":"CWE-1325","description":"CWE-1325 Improperly controlled sequential memory allocation","lang":"en","type":"CWE"}]},{"descriptions":[{"cweId":"CWE-1419","description":"CWE-1419 Incorrect Initialization of Resource","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-10-21T13:48:34.845Z","orgId":"dd77f84a-d19a-4638-8c3d-a322d820ed2b","shortName":"php"},"references":[{"tags":["vendor-advisory"],"url":"https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w"}],"source":{"discovery":"UNKNOWN"},"title":"RCE via OOM corruption","workarounds":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"Check the GitHub Security Advisory for mitigation strategies."}],"value":"Check the GitHub Security Advisory for mitigation strategies."}],"x_generator":{"engine":"Vulnogram 1.0.5"}}},"cveMetadata":{"assignerOrgId":"dd77f84a-d19a-4638-8c3d-a322d820ed2b","assignerShortName":"php","cveId":"CVE-2026-109618","datePublished":"2026-10-21T13:48:34.845Z","dateReserved":"2026-10-12T21:03:58.117Z","dateUpdated":"2026-10-21T16:07:52.535Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-10-21 14:17:09","lastModifiedDate":"2026-10-21 17:18:24","problem_types":["CWE-416","CWE-755","CWE-824","CWE-1325","CWE-416 CWE-416 Use after free","CWE-755 CWE-755 Improper Handling of Exceptional Conditions","CWE-824 CWE-824 Access of uninitialized pointer","CWE-1325 CWE-1325 Improperly controlled sequential memory allocation","CWE-1419 CWE-1419 Incorrect Initialization of Resource"],"metrics":{"cvssMetricV40":[{"source":"security@php.net","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":9.2,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"HIGH","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-21T14:34:39.479770Z","id":"CVE-2026-109618","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","versionEndExcluding":"8.2.35","matchCriteriaId":"80F659BB-0C5C-4F1B-8323-AE52F32C3BE4"},{"vulnerable":true,"criteria":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","versionStartIncluding":"8.3.0","versionEndExcluding":"8.3.36","matchCriteriaId":"40BD58D9-94BD-41B6-9DDA-30CA729409FB"},{"vulnerable":true,"criteria":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","versionStartIncluding":"8.4.0","versionEndExcluding":"8.4.27","matchCriteriaId":"D057202A-94FF-4118-A41F-BA8ABB76346E"},{"vulnerable":true,"criteria":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","versionStartIncluding":"8.5.0","versionEndExcluding":"8.5.12","matchCriteriaId":"CAF7FA75-7F87-405F-A222-C5C17D42C31F"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"109618","Ordinal":"1","Title":"RCE via OOM corruption","CVE":"CVE-2026-109618","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"109618","Ordinal":"1","NoteData":"PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE).","Type":"Description","Title":"RCE via OOM corruption"}]}}}