CVE-2026-109618
PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE).
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
More exploitable than 100% of all CVEs · Top 0%
of the sites UNPWNED scans run PHP, the technology this CVE affects. Version determines exposure, so scan yours to know for sure.Aggregate across 777 scanned sites. No site is identified.
Is your site exposed to this?
Run a free scan. UNPWNED fingerprints your stack and flags this CVE class if the affected technology is detected.
- Published
- 2026-10-21
- Last modified
- 2026-10-23
- Affected
- PHP
Related exploited CVEs in PHP
Data from the National Vulnerability Database (NVD), CISA KEV, and FIRST.org EPSS. This product uses the NVD API but is not endorsed or certified by the NVD. EPSS is a probability estimate, not a guarantee of exploitation.