CVE-2026-109618: RCE via OOM corruption
Last updated 21 October 2026
Other sources
PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE).
— MITRE
Affected Software
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The issue is described as remotely exploitable through request handling. An attacker needs to trigger an out-of-memory condition in a vulnerable request-processing context.
Is the out-of-memory condition considered reliably triggerable?
Yes. The advisory states that multiple OOM strategies can consistently trigger the affected condition, which can result in remote code execution.