Main Vulnerability Database Vulnerabilities #VU156712

Use-after-free in PHP - CVE-2026-109619

Published: October 21, 2026

Vulnerability identifier: #VU156712

CSH Severity: Critical

CVSS v4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-109619

CWE-ID: CWE-416

Exploitation vector: Remote access

Exploit availability: Public exploit is available

Vulnerability details

The vulnerability allows a remote attacker to disclose memory and execute arbitrary code with the web worker's privileges.

The vulnerability exists due to use-after-free in PHP's request lifecycle and persistent worker global state when operations access request-owned memory after it has been freed and before normal initialization of a subsequent request. A remote attacker can send crafted HTTP requests that leave stale state after interrupted operations or shutdown diagnostics, then trigger early error or session handling in another request processed by the same worker to disclose memory and, with a strategically crafted heap layout, execute arbitrary code.

Affected software

PHP
Debian Linux
Arch Linux
Gentoo Linux
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for x86_64
Fedora
php (Red Hat package)
php
dev-lang/php
php-legacy
php8.4 (Debian package)

How to mitigate CVE-2026-109619

Install security update from vendor's website.

PHP - addressed in versions 8.2.35, 8.3.36, 8.4.27, 8.5.12
php (Red Hat package) - update to 8.0.30-8.el9_8.1
php - addressed in versions 8.4.27-2.fc43, 8.5.12-1.fc44, 8.5.12-1.fc45
dev-lang/php - update to 5.6.28
php-legacy - update to 8.3.36-1
php - update to 8.5.12-1
php8.4 (Debian package) - update to 8.4.27-1~deb13u1

Links to Public Exploits and PoC-codes

External References

https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp