Use-after-free in PHP - CVE-2026-109618

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU156711

Use-after-free in PHP - CVE-2026-109618

Published: October 21, 2026


Vulnerability identifier: #VU156711
CSH Severity: Critical
CVSS v4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-109618
CWE-ID: CWE-416
Exploitation vector: Remote access
Exploit availability: Public exploit is available

Vulnerability details

The vulnerability allows a remote attacker to execute arbitrary code as the web worker account.

The vulnerability exists due to improper handling of out-of-memory exceptions in PHP's request lifecycle when allocation failures trigger longjmp() while incompletely initialized request memory is reachable. A remote attacker can send specially crafted HTTP requests that exhaust memory, including multipart requests, to leave invalid memory state that is subsequently processed during request shutdown, leading to arbitrary code execution.

FPM susceptibility is supported by source analysis, but no complete FPM exploit has been demonstrated.


Affected software

PHP
Debian Linux
Arch Linux
Gentoo Linux
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for x86_64
Fedora
php (Red Hat package)
php
dev-lang/php
php-legacy
php8.4 (Debian package)

How to mitigate CVE-2026-109618

Install security update from vendor's website.

PHP - addressed in versions 8.2.35, 8.3.36, 8.4.27, 8.5.12
php (Red Hat package) - update to 8.0.30-8.el9_8.1
php - addressed in versions 8.4.27-2.fc43, 8.5.12-1.fc44, 8.5.12-1.fc45
dev-lang/php - update to 5.6.28
php-legacy - update to 8.3.36-1
php - update to 8.5.12-1
php8.4 (Debian package) - update to 8.4.27-1~deb13u1

Links to Public Exploits and PoC-codes

External References

Related Security Bulletins