CVE-2026-109618

Analyzed Analyzed - Analysis Complete

PHP OOM Handling Remote Code Execution

Publication date: 2026-10-21

Last updated on: 2026-11-02

Assigner: PHP Group

Description

PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-21

Last Modified

2026-11-02

Generated

2026-11-03

AI Q&A

2026-10-21

EPSS Evaluated

2026-11-01

NVD

CVE-2026-109618

EUVD

EUVD-2026-107260

Affected Vendors & Products

Vendor	Product	Version / Range
siemens	blueplanet_360_nx3_m6_wm_od_iisx_firmware	*
siemens	blueplanet_360_nx3_m6_wm_od_iisx-s_firmware	*
siemens	energy_engage	2.0
siemens	energy_engage	3.1
siemens	spectrum_power_4	*
siemens	spectrum_power_7	*
siemens	spectrum_power_tg	*
siemens	amis_ts	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-824	The product accesses or uses a pointer that has not been initialized.
CWE-755	The product does not handle or incorrectly handles an exceptional condition.
CWE-416	The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
CWE-1325	The product manages a group of objects or resources and performs a separate memory allocation for each object, but it does not properly limit the total amount of memory that is consumed by all of the combined objects.

Attack-Flow Graph

Executive Summary

CVE-2026-109618 is a critical remote code execution (RCE) vulnerability in PHP versions prior to 8.2.35, 8.3.36, 8.4.27, and 8.5.12. It occurs due to improper handling of out-of-memory (OOM) errors using longjmp(), which leaves request memory in an invalid state. Attackers can exploit this by triggering OOM conditions through malicious requests, leading to RCE as the web server user.

Detection Guidance

Detecting CVE-2026-109618 requires checking PHP version against patched releases (8.2.35, 8.3.36, 8.4.27, 8.5.12). Use commands like 'php -v' to check version. Monitor for unusual memory corruption patterns or crashes during request processing, especially with multipart form data or large allocations.

Impact Analysis

This vulnerability allows attackers to execute arbitrary code on affected servers without authentication. They could take control of servers, steal sensitive data like passwords or API keys, deface websites, or perform other malicious actions. Any application running on a vulnerable PHP version is at risk, even if the application itself is secure.

Compliance Impact

This vulnerability allows remote code execution (RCE) on affected PHP servers, which could lead to unauthorized access to sensitive data such as personal information, health records, or other regulated data. Compliance with GDPR and HIPAA could be severely impacted if such data is exposed or mishandled due to this flaw.

Mitigation Strategies

Immediately update PHP to versions 8.2.35, 8.3.36, 8.4.27, or 8.5.12. If updating is not possible, set 'memory_limit=-1' and enforce frontend size limits, reduce nesting levels in requests, and block multipart form data if unused. Disable vulnerable SAPIs like mod_php if feasible.

Hi! I’m here to help you understand CVE-2026-109618. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...