CVE-2026-109618

9.8 CRITICALpublic exploit available

Published 2026-10-21 · Updated 2026-10-26

AI risk analysis

Summary: PHP's improper handling of out-of-memory (OOM) errors using longjmp() can leave request memory uninitialized, causing subsequent cleanup routines to read or branch on invalid data—potentially leading to remote code execution (RCE). This affects multiple products including PHP itself and embedded systems like RuggedCom APE1808 firmware.
Exploitability: Exploitation requires triggering specific OOM conditions under controlled network requests, but is considered straightforward for an unauthenticated remote attacker given the CVSS 9.8 score and public exploit references.
Blast radius: Successful exploitation allows full system compromise (CIA impact: high) across affected web servers and industrial control devices, enabling complete data theft, modification, or service disruption.
Detection: No reliable host or network indicator is derivable from the published description.
Prioritized remediation: Upgrade PHP to version 8.3.16 or later (fixed in commit https://github.com/php/php-src/commit/7f9e0b5a2d), and apply Siemens' advisory for RuggedCom APE1808 firmware (patch level not yet specified by vendor as of publication); for PAN-OS, upgrade to version 11.2.2 or later per Palo Alto Networks advisory.

rceoomphpicsuninit-memorylongjmp

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.

NVD description

PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE).

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-416, CWE-755, CWE-824, CWE-1325

Vendors

php, siemens, paloaltonetworks

Products

php, ruggedcom ape1808 firmware, ruggedcom ape1808, pan-os, panorama m-200, panorama m-300, panorama m-500, panorama m-600, panorama m-700, panorama virtual appliance, wf-500, wf-500-b

Public exploit & PoC references

https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w[Mitigation, Vendor Advisory]

All references

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

Related by shared AI tags and CWE weakness class. Browse the full archive.