PHP RCE via OOM corruption October 2026
CVE-2026-109618 Published on October 21, 2026

RCE via OOM corruption
PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE).

Vendor Advisory NVD

Known Exploited Vulnerability

This PHP Memory Corruption Vulnerability is part of CISA's list of Known Exploited Vulnerabilities. PHP contains an out-of-memory corruption vulnerability that allows for unauthenticated remote code execution.

The following remediation steps are recommended / required by October 29, 2026: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicab

Vulnerability Analysis

CVE-2026-109618 is exploitable with network access, and does not require authorization privileges or user interaction. This vulnerability is consided to have a high level of attack complexity. This vulnerability is known to be actively exploited by threat actors. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity and availability.

Attack Vector:

NETWORK

Attack Complexity:

HIGH

Privileges Required:

NONE

User Interaction:

NONE

Weakness Types

What is a Dangling pointer Vulnerability?

Referencing memory after it has been freed can cause a program to crash, use unexpected values, or execute code.

CVE-2026-109618 has been classified to as a Dangling pointer vulnerability or weakness.

Improper Handling of Exceptional Conditions

The software does not handle or incorrectly handles an exceptional condition.

Access of Uninitialized Pointer

The program accesses or uses a pointer that has not been initialized.

What is a Stack Exhaustion Vulnerability?

The product manages a group of objects or resources and performs a separate memory allocation for each object, but it does not properly limit the total amount of memory that is consumed by all of the combined objects.

CVE-2026-109618 has been classified to as a Stack Exhaustion vulnerability or weakness.

CWE-1419

Products Associated with CVE-2026-109618

You can be notified by email with stack.watch whenever vulnerabilities like CVE-2026-109618 are published in these products:

Canonical Ubuntu Linux

Amazon Aws

Oracle

PHP

Siemens Capital

Siemens Opcenter Execution Foundation

Siemens Opcenter Intelligence

Siemens Opcenter Quality

Siemens Polarion

Siemens Solid Edge

Siemens Teamcenter

Siemens Teamcenter Visualization

Siemens Tecnomatix Plant Simulation

Siemens Xpedition Enterprise

Siemens Spectrum Power 4

Siemens Spectrum Power 7

Affected Versions

PHP Group PHP:

Version 8.2.* and below 8.2.35 is affected.
Version 8.3.* and below 8.3.36 is affected.
Version 8.4.* and below 8.4.27 is affected.
Version 8.5.* and below 8.5.12 is affected.

Siemens AX4:

Before * is unaffected.

Siemens CADRA:

Before * is unaffected.

Siemens Capital:

Before * is unaffected.

Siemens Designcenter:

Before * is unaffected.

Siemens Designcenter X:

Before * is unaffected.

Siemens DFMExpress:

Before * is unaffected.

Siemens HyperLynx:

Before * is unaffected.

Siemens Insights Hub:

Before * is unaffected.

Siemens Opcenter Connect Electronics:

Before * is unaffected.

Siemens Opcenter Connect MOM:

Before * is unaffected.

Siemens Opcenter Execution Core:

Before * is unaffected.

Siemens Opcenter Execution Foundation:

Before * is unaffected.

Siemens Opcenter Execution Pharma:

Before * is unaffected.

Siemens Opcenter Intelligence:

Before * is unaffected.

Siemens Opcenter Intra Plant Logistics:

Before * is unaffected.

Siemens Opcenter Quality:

Before * is unaffected.

Siemens Opcenter RDnL:

Before * is unaffected.

Siemens Opcenter X:

Before * is unaffected.

Siemens PADS Pro Essentials:

Before * is unaffected.

Siemens PADS Pro Student Edition:

Before * is unaffected.

Siemens PADS Professional:

Before * is unaffected.

Siemens PADS Professional - XCR:

Before * is unaffected.

Siemens PADS Standard - XCR:

Before * is unaffected.

Siemens PADS Standard & Standard Plus:

Before * is unaffected.

Siemens Polarion:

Before * is unaffected.

Siemens QuadView:

Before * is unaffected.

Siemens RUGGEDCOM APE1808:

Before * is affected.

Siemens Simcenter Flomaster:

Before * is unaffected.

Siemens Simcenter Flux:

Before * is unaffected.

Siemens Simcenter Simlab:

Before * is unaffected.

Siemens Solid Edge:

Before * is unaffected.

Siemens Solid Edge:

Before * is unaffected.

Siemens Supply Chain Suite:

Before * is unaffected.

Siemens Teamcenter:

Before * is unaffected.

Siemens Teamcenter Product Cost Management:

Before * is unaffected.

Siemens Teamcenter Visualization:

Before * is unaffected.

Siemens Tecnomatix Plant Simulation:

Before * is unaffected.

Siemens TestWay:

Before * is unaffected.

Siemens Valor NPI:

Before * is unaffected.

Siemens Xcargo:

Before * is unaffected.

Siemens Xpedition Designer:

Before * is unaffected.

Siemens Xpedition Enterprise:

Before * is unaffected.

Siemens Xpedition Enterprise XCR:

Before * is unaffected.

Siemens Xpedition IC Packaging:

Before * is unaffected.

Siemens Xpedition Layout Browser:

Before * is unaffected.

Siemens AMIS TS:

Before * is affected.

Siemens blueplanet 360 NX3 M6 WM OD IISX:

Before * is affected.

Siemens blueplanet 360 NX3 M6 WM OD IISX - S:

Before * is affected.

Siemens Energy Engage V2.0SP9:

Before * is affected.

Siemens Energy Engage V3.1SP1:

Before * is affected.

Siemens Spectrum Power 4:

Before * is affected.

Siemens Spectrum Power 4:

Before * is affected.

Siemens Spectrum Power 4:

Before * is affected.

Siemens Spectrum Power 7:

Before * is affected.

Siemens Spectrum Power TG:

Before * is affected.

PHP RCE via OOM corruption October 2026CVE-2026-109618 Published on October 21, 2026

Known Exploited Vulnerability

Vulnerability Analysis

Weakness Types

What is a Dangling pointer Vulnerability?

Improper Handling of Exceptional Conditions

Access of Uninitialized Pointer

What is a Stack Exhaustion Vulnerability?

Products Associated with CVE-2026-109618

Affected Versions

PHP RCE via OOM corruption October 2026
CVE-2026-109618 Published on October 21, 2026