CVE-2026-109618: php group php Incorrect Initialization of Resource

Vulnerability summary

CVE-2026-109618 is a critical (CVSS 9.8) Incorrect Initialization of Resource vulnerability in php group php.

Timeline

1. 21-10-2026
   PublishedVulnerability first disclosed.
2. 21-10-2026
   Last modifiedVulnerability information updated.

Description

PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE).

• CWE-1419Incorrect Initialization of ResourceThe product attempts to initialize a resource but does not correctly do so, which might leave the resource in an unexpected, incorrect, or insecure state when it is accessed.
• CWE-416Use After FreeThe product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
• CWE-755Improper Handling of Exceptional ConditionsThe product does not handle or incorrectly handles an exceptional condition.
• CWE-824Access of Uninitialized PointerThe product accesses or uses a pointer that has not been initialized.
• CWE-1325Improperly Controlled Sequential Memory AllocationThe product manages a group of objects or resources and performs a separate memory allocation for each object, but it does not properly limit the total amount of memory that is consumed by all of the combined objects.