SB20261021131 - Debian update for php8.4
Published: October 21, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 2 vulnerabilities.
1) Use-after-free (CVE-ID: CVE-2026-109618)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to execute arbitrary code as the web worker account.
The vulnerability exists due to improper handling of out-of-memory exceptions in PHP's request lifecycle when allocation failures trigger longjmp() while incompletely initialized request memory is reachable. A remote attacker can send specially crafted HTTP requests that exhaust memory, including multipart requests, to leave invalid memory state that is subsequently processed during request shutdown, leading to arbitrary code execution.
FPM susceptibility is supported by source analysis, but no complete FPM exploit has been demonstrated.
2) Use-after-free (CVE-ID: CVE-2026-109619)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to disclose memory and execute arbitrary code with the web worker's privileges.
The vulnerability exists due to use-after-free in PHP's request lifecycle and persistent worker global state when operations access request-owned memory after it has been freed and before normal initialization of a subsequent request. A remote attacker can send crafted HTTP requests that leave stale state after interrupted operations or shutdown diagnostics, then trigger early error or session handling in another request processed by the same worker to disclose memory and, with a strategically crafted heap layout, execute arbitrary code.
Remediation
Install update from vendor's website.