CVE-2026-109618Critical· 9.2▾ AbyssalPoC availablePHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performin…
▾ Abyssal zone — Critical with a public exploit or in-the-wild use
impact 50.6 · likelihood 0 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Public exploit / PoC code seen in 1 source. Availability, not in-the-wild use.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
73 GitHub repos (last check)
PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE).
php-src >= 8.2.* < 8.2.35php-src >= 8.3.* < 8.3.36php-src >= 8.4.* < 8.4.27php-src >= 8.5.* < 8.5.12Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Check the GitHub Security Advisory for mitigation strategies.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-109619Critical· 9.2RCE via stale global state
CVE-2026-6103Medium· 4.3phar_tar_number() parses the octal size field of a TAR header into a uint32_t with no overflow check
CVE-2026-17545Medium· 6.9On Windows, PHP's filesystem and stream APIs do not reject reserved device names such as CON, PRN, AUX, NUL, COM1 to COM9, LPT1 to LPT9, CONIN$ and CONOUT$ when they appear as a component of a path
CVE-2025-14181Medium· 6.5The SOAP HTTP client guards its response buffer growth with a check that relies on signed integer overflow, which is undefined behaviour and is not guaranteed to trigger
CVE-2026-93682Medium· 5.8When the HTTP stream wrapper follows a redirect and the response carries a Location header with an empty value, the redirect code reads one byte past the end of the heap buffer holding the location
CVE-2022-26485High· 8.8Removing an XSLT parameter during processing could have lead to an exploitable use-after-free