Summary
PHP insecurely handles multiple combinations of memory allocations and error conditions. These behaviors can allow a remote attacker to cause a denial of service or execute arbitrary code. Successful exploitation depends on a number of factors including the specific PHP application being targeted, the SAPI and web server, error handling and memory resource configuration, and platform or OS-level memory protections. Without significant analysis effort to prove otherwise, any application running on a vulnerable version of PHP should be considered vulnerable and exploitable.
Vulnerabilities 2
-
Critical 9.2
RCE via OOM corruption
PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The s…
KEV Oct 26, 2026 -
Critical 9.2
RCE via stale global state
PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subs…
KEV Oct 26, 2026
Revision history
-
#1.0.0
Initial publication