Summary
Two memory-safety vulnerabilities in the PHP runtime bundled with SMART EMS allow an unauthenticated remote attacker to execute arbitrary code in the context of the PHP web worker. All SMART EMS versions up to and including v3.5.3 are affected. Exploitability and reliability depend on the PHP server interface, configuration, application behaviour, and worker reuse.
Vulnerabilities 2
-
Critical 9.2
RCE via OOM corruption
PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The s…
KEV Oct 26, 2026 -
Critical 9.2
RCE via stale global state
PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subs…
KEV Oct 26, 2026
Revision history
-
#1.0.0
Initial release.
References
-
Welotec PSIRT
https://welotec.com/de/pages/coordinated-vulnerability-disclosure-policy
-
CERT@VDE Security Advisories for Welotec
https://certvde.com/de/advisories/vendor/welotec
-
VDE-2026-127: Welotec: PHP2Shell Vulnerabilities in SMART EMS - HTML
https://certvde.com/en/advisories/VDE-2026-127