{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-109618", "assignerOrgId": "dd77f84a-d19a-4638-8c3d-a322d820ed2b", "state": "PUBLISHED", "assignerShortName": "php", "dateReserved": "2026-10-12T21:03:58.117Z", "datePublished": "2026-10-21T13:48:34.845Z", "dateUpdated": "2026-10-22T23:04:19.783Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "dd77f84a-d19a-4638-8c3d-a322d820ed2b", "shortName": "php", "dateUpdated": "2026-10-21T13:48:34.845Z"}, "title": "RCE via OOM corruption", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-416", "description": "CWE-416 Use after free", "type": "CWE"}]}, {"descriptions": [{"lang": "en", "cweId": "CWE-755", "description": "CWE-755 Improper Handling of Exceptional Conditions", "type": "CWE"}]}, {"descriptions": [{"lang": "en", "cweId": "CWE-824", "description": "CWE-824 Access of uninitialized pointer", "type": "CWE"}]}, {"descriptions": [{"lang": "en", "cweId": "CWE-1325", "description": "CWE-1325 Improperly controlled sequential memory allocation", "type": "CWE"}]}, {"descriptions": [{"lang": "en", "cweId": "CWE-1419", "description": "CWE-1419 Incorrect Initialization of Resource", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-234", "descriptions": [{"lang": "en", "value": "CAPEC-234 Hijacking a privileged process"}]}], "affected": [{"vendor": "PHP Group", "product": "PHP", "packageName": "php-src", "versions": [{"status": "affected", "version": "8.2.*", "lessThan": "8.2.35", "versionType": "semver"}, {"status": "affected", "version": "8.3.*", "lessThan": "8.3.36", "versionType": "semver"}, {"status": "affected", "version": "8.4.*", "lessThan": "8.4.27", "versionType": "semver"}, {"status": "affected", "version": "8.5.*", "lessThan": "8.5.12", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE).", "supportingMedia": [{"type": "text/html", "base64": false, "value": "PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE).<br>"}]}], "references": [{"url": "https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w", "tags": ["vendor-advisory"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "CRITICAL", "baseScore": 9.2, "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}}], "workarounds": [{"lang": "en", "value": "Check the GitHub Security Advisory for mitigation strategies.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Check the GitHub Security Advisory for mitigation strategies."}]}], "credits": [{"lang": "en", "value": "Ryan at Calif.io", "type": "reporter"}, {"lang": "en", "value": "Wiz", "type": "reporter"}, {"lang": "en", "value": "OpenAI", "type": "finder"}, {"lang": "en", "value": "Arnaud Le Blanc", "type": "remediation developer"}, {"lang": "en", "value": "Ilija Tovilo", "type": "remediation developer"}, {"lang": "en", "value": "Jakub Zelenka", "type": "remediation developer"}, {"lang": "en", "value": "Nora Dossche", "type": "remediation developer"}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 1.0.5"}, "x_gcve": [{"vulnId": "CVE-2026-109618", "recordType": "advisory"}]}, "adp": [{"references": [{"url": "https://www.wiz.io/blog/php2shell-php-rce", "tags": ["third-party-advisory"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-10-21T00:00:00+00:00", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3", "id": "CVE-2026-109618"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-22T23:04:19.783Z"}}, {"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/10/21/6"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-10-21T16:07:52.535Z"}}]}, "vulnerability-lookup:meta": {"epss": {"cve": "CVE-2026-109618", "date": "2026-10-22", "epss": "0.05307", "percentile": "0.92563"}, "nvd": "{\"cve\":{\"id\":\"CVE-2026-109618\",\"sourceIdentifier\":\"security@php.net\",\"published\":\"2026-10-21T14:17:09.357\",\"lastModified\":\"2026-10-22T23:18:22.073\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE).\"},{\"lang\":\"es\",\"value\":\"PHP utiliza la funci\u00f3n `longjmp()` para los errores de falta de memoria (OOM), con el fin de salir del contexto actual y abortar la gesti\u00f3n de la solicitud. Es posible que algunos contextos no tengan debidamente en cuenta esta situaci\u00f3n y dejen la memoria de la solicitud en un estado no inicializado antes de realizar una asignaci\u00f3n. El procedimiento posterior de limpieza de la solicitud podr\u00eda leer o realizar una ramificaci\u00f3n en esta memoria. Existen m\u00faltiples estrategias de gesti\u00f3n de OOM que pueden desencadenar esta condici\u00f3n de forma sistem\u00e1tica y dar lugar a la ejecuci\u00f3n remota de c\u00f3digo (RCE).\"}],\"affected\":[{\"source\":\"security@php.net\",\"affectedData\":[{\"vendor\":\"PHP Group\",\"product\":\"PHP\",\"defaultStatus\":\"unaffected\",\"packageName\":\"php-src\",\"versions\":[{\"version\":\"8.2.*\",\"lessThan\":\"8.2.35\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"8.3.*\",\"lessThan\":\"8.3.36\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"8.4.*\",\"lessThan\":\"8.4.27\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"8.5.*\",\"lessThan\":\"8.5.12\",\"versionType\":\"semver\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV40\":[{\"source\":\"security@php.net\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"4.0\",\"vectorString\":\"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X\",\"baseScore\":9.2,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"HIGH\",\"attackRequirements\":\"PRESENT\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"vulnConfidentialityImpact\":\"HIGH\",\"vulnIntegrityImpact\":\"HIGH\",\"vulnAvailabilityImpact\":\"HIGH\",\"subConfidentialityImpact\":\"NONE\",\"subIntegrityImpact\":\"NONE\",\"subAvailabilityImpact\":\"NONE\",\"exploitMaturity\":\"NOT_DEFINED\",\"confidentialityRequirement\":\"NOT_DEFINED\",\"integrityRequirement\":\"NOT_DEFINED\",\"availabilityRequirement\":\"NOT_DEFINED\",\"modifiedAttackVector\":\"NOT_DEFINED\",\"modifiedAttackComplexity\":\"NOT_DEFINED\",\"modifiedAttackRequirements\":\"NOT_DEFINED\",\"modifiedPrivilegesRequired\":\"NOT_DEFINED\",\"modifiedUserInteraction\":\"NOT_DEFINED\",\"modifiedVulnConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedVulnIntegrityImpact\":\"NOT_DEFINED\",\"modifiedVulnAvailabilityImpact\":\"NOT_DEFINED\",\"modifiedSubConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedSubIntegrityImpact\":\"NOT_DEFINED\",\"modifiedSubAvailabilityImpact\":\"NOT_DEFINED\",\"Safety\":\"NOT_DEFINED\",\"Automatable\":\"NOT_DEFINED\",\"Recovery\":\"NOT_DEFINED\",\"valueDensity\":\"NOT_DEFINED\",\"vulnerabilityResponseEffort\":\"NOT_DEFINED\",\"providerUrgency\":\"NOT_DEFINED\"}}],\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.9}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-10-21T00:00:00+00:00\",\"id\":\"CVE-2026-109618\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"total\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"security@php.net\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-416\"},{\"lang\":\"en\",\"value\":\"CWE-755\"},{\"lang\":\"en\",\"value\":\"CWE-824\"},{\"lang\":\"en\",\"value\":\"CWE-1325\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"8.2.35\",\"matchCriteriaId\":\"80F659BB-0C5C-4F1B-8323-AE52F32C3BE4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"8.3.0\",\"versionEndExcluding\":\"8.3.36\",\"matchCriteriaId\":\"40BD58D9-94BD-41B6-9DDA-30CA729409FB\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"8.4.0\",\"versionEndExcluding\":\"8.4.27\",\"matchCriteriaId\":\"D057202A-94FF-4118-A41F-BA8ABB76346E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"8.5.0\",\"versionEndExcluding\":\"8.5.12\",\"matchCriteriaId\":\"CAF7FA75-7F87-405F-A222-C5C17D42C31F\"}]}]}],\"references\":[{\"url\":\"https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w\",\"source\":\"security@php.net\",\"tags\":[\"Mitigation\",\"Vendor Advisory\"]},{\"url\":\"http://www.openwall.com/lists/oss-security/2026/10/21/6\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"https://www.wiz.io/blog/php2shell-php-rce\",\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"tags\":[\"Third Party Advisory\"]}]}}", "redhat_vex": {"aggregate_severity": "Important", "current_release_date": "2026-10-23T10:01:02+00:00", "cve": "CVE-2026-109618", "id": "CVE-2026-109618", "initial_release_date": "2026-10-21T14:00:00+00:00", "product_status:fixed": "2568", "product_status:known_affected": "55", "product_status:known_not_affected": "28", "source": "Red Hat CSAF VEX", "status": "final", "title": "php: OOM bailout during request parsing leads to memory corruption and RCE", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-109618.json", "version": "3"}, "vulnrichment": {"containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"http://www.openwall.com/lists/oss-security/2026/10/21/6\"}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2026-10-21T16:07:52.535Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-109618\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-10-21T14:34:39.479770Z\"}}}], \"references\": [{\"url\": \"https://www.wiz.io/blog/php2shell-php-rce\", \"tags\": [\"third-party-advisory\"]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-10-21T14:36:08.475Z\"}}], \"cna\": {\"title\": \"RCE via OOM corruption\", \"source\": {\"discovery\": \"UNKNOWN\"}, \"credits\": [{\"lang\": \"en\", \"type\": \"reporter\", \"value\": \"Ryan at Calif.io\"}, {\"lang\": \"en\", \"type\": \"reporter\", \"value\": \"Wiz\"}, {\"lang\": \"en\", \"type\": \"finder\", \"value\": \"OpenAI\"}, {\"lang\": \"en\", \"type\": \"remediation developer\", \"value\": \"Arnaud Le Blanc\"}, {\"lang\": \"en\", \"type\": \"remediation developer\", \"value\": \"Ilija Tovilo\"}, {\"lang\": \"en\", \"type\": \"remediation developer\", \"value\": \"Jakub Zelenka\"}, {\"lang\": \"en\", \"type\": \"remediation developer\", \"value\": \"Nora Dossche\"}], \"impacts\": [{\"capecId\": \"CAPEC-234\", \"descriptions\": [{\"lang\": \"en\", \"value\": \"CAPEC-234 Hijacking a privileged process\"}]}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV4_0\": {\"Safety\": \"NOT_DEFINED\", \"version\": \"4.0\", \"Recovery\": \"NOT_DEFINED\", \"baseScore\": 9.2, \"Automatable\": \"NOT_DEFINED\", \"attackVector\": \"NETWORK\", \"baseSeverity\": \"CRITICAL\", \"valueDensity\": \"NOT_DEFINED\", \"vectorString\": \"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N\", \"exploitMaturity\": \"NOT_DEFINED\", \"providerUrgency\": \"NOT_DEFINED\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"HIGH\", \"attackRequirements\": \"PRESENT\", \"privilegesRequired\": \"NONE\", \"subIntegrityImpact\": \"NONE\", \"vulnIntegrityImpact\": \"HIGH\", \"subAvailabilityImpact\": \"NONE\", \"vulnAvailabilityImpact\": \"HIGH\", \"subConfidentialityImpact\": \"NONE\", \"vulnConfidentialityImpact\": \"HIGH\", \"vulnerabilityResponseEffort\": \"NOT_DEFINED\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"vendor\": \"PHP Group\", \"product\": \"PHP\", \"versions\": [{\"status\": \"affected\", \"version\": \"8.2.*\", \"lessThan\": \"8.2.35\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"8.3.*\", \"lessThan\": \"8.3.36\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"8.4.*\", \"lessThan\": \"8.4.27\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"8.5.*\", \"lessThan\": \"8.5.12\", \"versionType\": \"semver\"}], \"packageName\": \"php-src\", \"defaultStatus\": \"unaffected\"}], \"references\": [{\"url\": \"https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w\", \"tags\": [\"vendor-advisory\"]}], \"workarounds\": [{\"lang\": \"en\", \"value\": \"Check the GitHub Security Advisory for mitigation strategies.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"Check the GitHub Security Advisory for mitigation strategies.\", \"base64\": false}]}], \"x_generator\": {\"engine\": \"Vulnogram 1.0.5\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE).\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE).<br>\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-416\", \"description\": \"CWE-416 Use after free\"}]}, {\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-755\", \"description\": \"CWE-755 Improper Handling of Exceptional Conditions\"}]}, {\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-824\", \"description\": \"CWE-824 Access of uninitialized pointer\"}]}, {\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-1325\", \"description\": \"CWE-1325 Improperly controlled sequential memory allocation\"}]}, {\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-1419\", \"description\": \"CWE-1419 Incorrect Initialization of Resource\"}]}], \"providerMetadata\": {\"orgId\": \"dd77f84a-d19a-4638-8c3d-a322d820ed2b\", \"shortName\": \"php\", \"dateUpdated\": \"2026-10-21T13:48:34.845Z\"}}}", "cveMetadata": "{\"cveId\": \"CVE-2026-109618\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-10-22T23:04:19.783Z\", \"dateReserved\": \"2026-10-12T21:03:58.117Z\", \"assignerOrgId\": \"dd77f84a-d19a-4638-8c3d-a322d820ed2b\", \"datePublished\": \"2026-10-21T13:48:34.845Z\", \"assignerShortName\": \"php\"}", "dataType": "CVE_RECORD", "dataVersion": "5.2"}}}