CVE-2026-109619: php group php Incorrect Initialization of Resource

Vulnerability summary

CVE-2026-109619 is a critical (CVSS 9.8) Incorrect Initialization of Resource vulnerability in php group php.

Timeline

1. 21-10-2026
   PublishedVulnerability first disclosed.
2. 21-10-2026
   Last modifiedVulnerability information updated.

Description

PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may read or branch on this stale state before it is fully initialized. Multiple strategies can trigger this condition and produce remote code execution (RCE).

• CWE-1419Incorrect Initialization of ResourceThe product attempts to initialize a resource but does not correctly do so, which might leave the resource in an unexpected, incorrect, or insecure state when it is accessed.
• CWE-416Use After FreeThe product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
• CWE-755Improper Handling of Exceptional ConditionsThe product does not handle or incorrectly handles an exceptional condition.
• CWE-824Access of Uninitialized PointerThe product accesses or uses a pointer that has not been initialized.
• CWE-1325Improperly Controlled Sequential Memory AllocationThe product manages a group of objects or resources and performs a separate memory allocation for each object, but it does not properly limit the total amount of memory that is consumed by all of the combined objects.