{"schemaVersion":3,"id":"CVE-2026-109618","aliases":["DEBIAN-CVE-2026-109618","UBUNTU-CVE-2026-109618","CGA-5w4x-7fch-f2cx","CGA-799f-vm39-p5vh","CGA-8phw-ww54-gpfc","CGA-gv4m-w4hh-x8f8","CGA-jqc7-qx97-xvrv","CGA-mjxf-rh4w-54ff","CGA-q9m8-jf7q-4xch","CGA-qrqp-vmm9-825p"],"status":"published","duplicateOf":null,"title":null,"description":"PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE).","dates":{"published":"2026-10-21T13:48:34.845Z","modified":"2026-10-21T16:07:52.535Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":9.8,"severity":"critical","version":"3.1","versionLabel":"v3.1","source":"NVD","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","computed":false,"selection":"backend-summary"},"metrics":[{"version":"4.0","versionLabel":"v4.0","source":"CVE.org","score":9.2,"severity":"critical","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","exploitability":null,"impact":null,"computed":false},{"version":"4.0","versionLabel":"v4.0","source":"NVD","score":9.2,"severity":"critical","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":9.8,"severity":"critical","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":null,"percentile":null,"severity":"unknown","asOf":null,"change":{"pp":null,"baselineDate":null,"baselineScore":null},"history":[],"last30":[]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[{"id":"CWE-1419","name":"Incorrect Initialization of Resource","description":"The product attempts to initialize a resource but does not correctly do so, which might leave the resource in an unexpected, incorrect, or insecure state when it is accessed.","type":"weakness","status":"Incomplete","abstraction":"Class","likelihoodOfExploit":null,"url":"https://cwe.mitre.org/data/definitions/1419.html"},{"id":"CWE-416","name":"Use After Free","description":"The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory \"belongs\" to the code that operates on the new pointer.","type":"weakness","status":"Stable","abstraction":"Variant","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/416.html"},{"id":"CWE-755","name":"Improper Handling of Exceptional Conditions","description":"The product does not handle or incorrectly handles an exceptional condition.","type":"weakness","status":"Incomplete","abstraction":"Class","likelihoodOfExploit":"Medium","url":"https://cwe.mitre.org/data/definitions/755.html"},{"id":"CWE-824","name":"Access of Uninitialized Pointer","description":"The product accesses or uses a pointer that has not been initialized.","type":"weakness","status":"Incomplete","abstraction":"Base","likelihoodOfExploit":null,"url":"https://cwe.mitre.org/data/definitions/824.html"},{"id":"CWE-1325","name":"Improperly Controlled Sequential Memory Allocation","description":"The product manages a group of objects or resources and performs a separate memory allocation for each object, but it does not properly limit the total amount of memory that is consumed by all of the combined objects.","type":"weakness","status":"Incomplete","abstraction":"Base","likelihoodOfExploit":null,"url":"https://cwe.mitre.org/data/definitions/1325.html"}],"affected":[{"vendor":"chainguard","product":"php-8.2","name":"php-8.2","label":"php-8.2","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/php-8.2","purlType":"apk","versions":[{"text":"< 8.2.34-r4","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 8.2.34-r4","eol":null,"hubHref":null},{"vendor":"chainguard","product":"php-8.3","name":"php-8.3","label":"php-8.3","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/php-8.3","purlType":"apk","versions":[{"text":"< 8.3.35-r4","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 8.3.35-r4","eol":null,"hubHref":null},{"vendor":"chainguard","product":"php-8.4","name":"php-8.4","label":"php-8.4","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/php-8.4","purlType":"apk","versions":[{"text":"< 8.4.26-r4","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 8.4.26-r4","eol":null,"hubHref":null},{"vendor":"chainguard","product":"php-8.5","name":"php-8.5","label":"php-8.5","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/php-8.5","purlType":"apk","versions":[{"text":"< 8.5.11-r4","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 8.5.11-r4","eol":null,"hubHref":null},{"vendor":"wolfi","product":"php-8.2","name":"php-8.2","label":"php-8.2","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/php-8.2","purlType":"apk","versions":[{"text":"< 8.2.34-r4","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 8.2.34-r4","eol":null,"hubHref":null},{"vendor":"wolfi","product":"php-8.3","name":"php-8.3","label":"php-8.3","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/php-8.3","purlType":"apk","versions":[{"text":"< 8.3.35-r4","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 8.3.35-r4","eol":null,"hubHref":null},{"vendor":"wolfi","product":"php-8.4","name":"php-8.4","label":"php-8.4","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/php-8.4","purlType":"apk","versions":[{"text":"< 8.4.26-r4","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 8.4.26-r4","eol":null,"hubHref":null},{"vendor":"wolfi","product":"php-8.5","name":"php-8.5","label":"php-8.5","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/php-8.5","purlType":"apk","versions":[{"text":"< 8.5.11-r4","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 8.5.11-r4","eol":null,"hubHref":null},{"vendor":"debian","product":"php8.2","name":"php8.2","label":"php8.2","ecosystem":"Debian","cpePart":null,"purl":"pkg:deb/debian/php8.2","purlType":"deb","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null},{"text":"< 8.2.35-1~deb12u1","noFixRecorded":false,"fixedIn":null}],"versionsText":"All versions (No fix recorded) | < 8.2.35-1~deb12u1","eol":null,"hubHref":null},{"vendor":"debian","product":"php8.4","name":"php8.4","label":"php8.4","ecosystem":"Debian","cpePart":null,"purl":"pkg:deb/debian/php8.4","purlType":"deb","versions":[{"text":"< 8.4.27-1~deb13u1","noFixRecorded":false,"fixedIn":null},{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"< 8.4.27-1~deb13u1 | All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"ubuntu","product":"php5","name":"php5","label":"php5","ecosystem":"Ubuntu","cpePart":null,"purl":"pkg:deb/ubuntu/php5","purlType":"deb","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"ubuntu","product":"php7.0","name":"php7.0","label":"php7.0","ecosystem":"Ubuntu","cpePart":null,"purl":"pkg:deb/ubuntu/php7.0","purlType":"deb","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"ubuntu","product":"php7.2","name":"php7.2","label":"php7.2","ecosystem":"Ubuntu","cpePart":null,"purl":"pkg:deb/ubuntu/php7.2","purlType":"deb","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"ubuntu","product":"php7.4","name":"php7.4","label":"php7.4","ecosystem":"Ubuntu","cpePart":null,"purl":"pkg:deb/ubuntu/php7.4","purlType":"deb","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"ubuntu","product":"php8.1","name":"php8.1","label":"php8.1","ecosystem":"Ubuntu","cpePart":null,"purl":"pkg:deb/ubuntu/php8.1","purlType":"deb","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"ubuntu","product":"php8.3","name":"php8.3","label":"php8.3","ecosystem":"Ubuntu","cpePart":null,"purl":"pkg:deb/ubuntu/php8.3","purlType":"deb","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"ubuntu","product":"php8.5","name":"php8.5","label":"php8.5","ecosystem":"Ubuntu","cpePart":null,"purl":"pkg:deb/ubuntu/php8.5","purlType":"deb","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"php group","product":"php","name":"PHP","label":"php","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ 8.2.*, < 8.2.35","noFixRecorded":false,"fixedIn":null},{"text":"≥ 8.3.*, < 8.3.36","noFixRecorded":false,"fixedIn":null},{"text":"≥ 8.4.*, < 8.4.27","noFixRecorded":false,"fixedIn":null},{"text":"≥ 8.5.*, < 8.5.12","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 8.2.*, < 8.2.35 | ≥ 8.3.*, < 8.3.36 | ≥ 8.4.*, < 8.4.27 | ≥ 8.5.*, < 8.5.12","eol":null,"hubHref":"/vendor/php_group/php"},{"vendor":"php","product":"php","name":"php","label":"php","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"< 8.2.35","noFixRecorded":false,"fixedIn":null},{"text":"≥ 8.3.0, < 8.3.36","noFixRecorded":false,"fixedIn":null},{"text":"≥ 8.4.0, < 8.4.27","noFixRecorded":false,"fixedIn":null},{"text":"≥ 8.5.0, < 8.5.12","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 8.2.35 | ≥ 8.3.0, < 8.3.36 | ≥ 8.4.0, < 8.4.27 | ≥ 8.5.0, < 8.5.12","eol":{"isEol":null,"eolDate":null,"matchMethod":"cpe","cycle":null,"product":{"name":"php","label":"PHP","category":"lang"}},"hubHref":"/vendor/php/php"}],"affectedCount":19,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w","label":"github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w","hostname":"github.com","tags":["Vendor Advisory","Mitigation"]},{"url":"https://www.wiz.io/blog/php2shell-php-rce","label":"www.wiz.io/blog/php2shell-php-rce","hostname":"www.wiz.io","tags":["Third Party Advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-109618","label":"security-tracker.debian.org/tracker/CVE-2026-109618","hostname":"security-tracker.debian.org","tags":["Advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2026/10/21/6","label":"www.openwall.com/lists/oss-security/2026/10/21/6","hostname":"www.openwall.com","tags":[]},{"url":"https://ubuntu.com/security/CVE-2026-109618","label":"ubuntu.com/security/CVE-2026-109618","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-109618","label":"www.cve.org/CVERecord?id=CVE-2026-109618","hostname":"www.cve.org","tags":["REPORT"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2026-10-21T13:48:34.845Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2026-10-21T16:07:52.535Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":70,"level":"high","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-21T22:57:57.377Z","stale":false,"partial":false}}