CVE-2026-109619

EUVD-2026-107265
PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may read or branch on this stale state before it is fully initialized. Multiple strategies can trigger this condition and produce remote code execution (RCE).
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
9.8 CRITICAL
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Affected Products (NVD)
VendorProductVersion
phpphp
𝑥
< 8.2.35
phpphp
8.3.0 ≤
𝑥
< 8.3.36
phpphp
8.4.0 ≤
𝑥
< 8.4.27
phpphp
8.5.0 ≤
𝑥
< 8.5.12
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
php8.2
bookworm
vulnerable
bookworm (security)
8.2.35-1~deb12u1
fixed
php8.4
forky
vulnerable
sid
vulnerable
trixie
vulnerable
trixie (security)
8.4.27-1~deb13u1
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
php5
jammy
dne
noble
dne
resolute
dne
stonking
dne
trusty
Fixed in 5.5.9+dfsg-1ubuntu4.29+esm18
released
php7.0
jammy
dne
noble
dne
resolute
dne
stonking
dne
xenial
Fixed in 7.0.33-0ubuntu0.16.04.16+esm22
released
php7.2
bionic
Fixed in 7.2.24-0ubuntu0.18.04.17+esm14
released
jammy
dne
noble
dne
resolute
dne
stonking
dne
php7.4
focal
Fixed in 7.4.3-4ubuntu2.29+esm5
released
jammy
dne
noble
dne
resolute
dne
stonking
dne
php8.1
jammy
Fixed in 8.1.2-1ubuntu2.28
released
noble
dne
resolute
dne
stonking
dne
php8.3
jammy
dne
noble
Fixed in 8.3.6-0ubuntu0.24.04.13
released
resolute
dne
stonking
dne
php8.5
jammy
dne
noble
dne
resolute
Fixed in 8.5.4-0ubuntu1.5
released
stonking
Fixed in 8.5.9-0ubuntu2.1
released
openSUSE logo
openSUSE / SLES Releases
openSUSE Product
Release
apache2-mod_php8
suse enterprise sap 15 SP6
8.2.35-150600.3.39.1
fixed
suse enterprise sap 15 SP7
8.3.36-150700.3.24.1
fixed
suse enterprise server 15 SP6
8.2.35-150600.3.39.1
fixed
suse enterprise server 15 SP7
8.3.36-150700.3.24.1
fixed
php8
suse enterprise sap 15 SP6
8.2.35-150600.3.39.1
fixed
suse enterprise sap 15 SP7
8.3.36-150700.3.24.1
fixed
suse enterprise server 15 SP6
8.2.35-150600.3.39.1
fixed
suse enterprise server 15 SP7
8.3.36-150700.3.24.1
fixed
php8-bcmath
suse enterprise sap 15 SP6
8.2.35-150600.3.39.1
fixed
suse enterprise sap 15 SP7
8.3.36-150700.3.24.1
fixed
suse enterprise server 15 SP6
8.2.35-150600.3.39.1
fixed
suse enterprise server 15 SP7
8.3.36-150700.3.24.1
fixed
php8-bz2
suse enterprise sap 15 SP6
8.2.35-150600.3.39.1
fixed
suse enterprise sap 15 SP7
8.3.36-150700.3.24.1
fixed
suse enterprise server 15 SP6
8.2.35-150600.3.39.1
fixed
suse enterprise server 15 SP7
8.3.36-150700.3.24.1
fixed
php8-calendar
suse enterprise sap 15 SP6
8.2.35-150600.3.39.1
fixed
suse enterprise sap 15 SP7
8.3.36-150700.3.24.1
fixed
suse enterprise server 15 SP6
8.2.35-150600.3.39.1
fixed
suse enterprise server 15 SP7
8.3.36-150700.3.24.1
fixed
php8-cli
suse enterprise sap 15 SP6
8.2.35-150600.3.39.1
fixed
suse enterprise sap 15 SP7
8.3.36-150700.3.24.1
fixed
suse enterprise server 15 SP6
8.2.35-150600.3.39.1
fixed
suse enterprise server 15 SP7
8.3.36-150700.3.24.1
fixed
php8-ctype
suse enterprise sap 15 SP6
8.2.35-150600.3.39.1
fixed
suse enterprise sap 15 SP7
8.3.36-150700.3.24.1
fixed
suse enterprise server 15 SP6
8.2.35-150600.3.39.1
fixed
suse enterprise server 15 SP7
8.3.36-150700.3.24.1
fixed
php8-curl
suse enterprise sap 15 SP6
8.2.35-150600.3.39.1
fixed
suse enterprise sap 15 SP7
8.3.36-150700.3.24.1
fixed
suse enterprise server 15 SP6
8.2.35-150600.3.39.1
fixed
suse enterprise server 15 SP7
8.3.36-150700.3.24.1
fixed
php8-dba
suse enterprise sap 15 SP6
8.2.35-150600.3.39.1
fixed
suse enterprise sap 15 SP7
8.3.36-150700.3.24.1
fixed
suse enterprise server 15 SP6
8.2.35-150600.3.39.1
fixed
suse enterprise server 15 SP7
8.3.36-150700.3.24.1
fixed
php8-devel
suse enterprise sap 15 SP6
8.2.35-150600.3.39.1
fixed
suse enterprise sap 15 SP7
8.3.36-150700.3.24.1
fixed
suse enterprise server 15 SP6
8.2.35-150600.3.39.1
fixed
suse enterprise server 15 SP7
8.3.36-150700.3.24.1
fixed
php8-dom
suse enterprise sap 15 SP6
8.2.35-150600.3.39.1
fixed
suse enterprise sap 15 SP7
8.3.36-150700.3.24.1
fixed
suse enterprise server 15 SP6
8.2.35-150600.3.39.1
fixed
suse enterprise server 15 SP7
8.3.36-150700.3.24.1
fixed
php8-embed
suse enterprise sap 15 SP6
8.2.35-150600.3.39.1
fixed
suse enterprise sap 15 SP7
8.3.36-150700.3.24.1
fixed
suse enterprise server 15 SP6
8.2.35-150600.3.39.1
fixed
suse enterprise server 15 SP7
8.3.36-150700.3.24.1
fixed
php8-enchant
suse enterprise sap 15 SP6
8.2.35-150600.3.39.1
fixed
suse enterprise sap 15 SP7
8.3.36-150700.3.24.1
fixed
suse enterprise server 15 SP6
8.2.35-150600.3.39.1
fixed
suse enterprise server 15 SP7
8.3.36-150700.3.24.1
fixed
php8-exif
suse enterprise sap 15 SP6
8.2.35-150600.3.39.1
fixed
suse enterprise sap 15 SP7
8.3.36-150700.3.24.1
fixed
suse enterprise server 15 SP6
8.2.35-150600.3.39.1
fixed
suse enterprise server 15 SP7
8.3.36-150700.3.24.1
fixed
php8-fastcgi
suse enterprise sap 15 SP6
8.2.35-150600.3.39.1
fixed
suse enterprise sap 15 SP7
8.3.36-150700.3.24.1
fixed
suse enterprise server 15 SP6
8.2.35-150600.3.39.1
fixed
suse enterprise server 15 SP7
8.3.36-150700.3.24.1
fixed
php8-fileinfo
suse enterprise sap 15 SP6
8.2.35-150600.3.39.1
fixed
suse enterprise sap 15 SP7
8.3.36-150700.3.24.1
fixed
suse enterprise server 15 SP6
8.2.35-150600.3.39.1
fixed
suse enterprise server 15 SP7
8.3.36-150700.3.24.1
fixed
php8-fpm
suse enterprise sap 15 SP6
8.2.35-150600.3.39.1
fixed
suse enterprise sap 15 SP7
8.3.36-150700.3.24.1
fixed
suse enterprise server 15 SP6
8.2.35-150600.3.39.1
fixed
suse enterprise server 15 SP7
8.3.36-150700.3.24.1
fixed
php8-ftp
suse enterprise sap 15 SP6
8.2.35-150600.3.39.1
fixed
suse enterprise sap 15 SP7
8.3.36-150700.3.24.1
fixed
suse enterprise server 15 SP6
8.2.35-150600.3.39.1
fixed
suse enterprise server 15 SP7
8.3.36-150700.3.24.1
fixed
php8-gd
suse enterprise sap 15 SP6
8.2.35-150600.3.39.1
fixed
suse enterprise sap 15 SP7
8.3.36-150700.3.24.1
fixed
suse enterprise server 15 SP6
8.2.35-150600.3.39.1
fixed
suse enterprise server 15 SP7
8.3.36-150700.3.24.1
fixed
php8-gettext
suse enterprise sap 15 SP6
8.2.35-150600.3.39.1
fixed
suse enterprise sap 15 SP7
8.3.36-150700.3.24.1
fixed
suse enterprise server 15 SP6
8.2.35-150600.3.39.1
fixed
suse enterprise server 15 SP7
8.3.36-150700.3.24.1
fixed
php8-gmp
suse enterprise sap 15 SP6
8.2.35-150600.3.39.1
fixed
suse enterprise sap 15 SP7
8.3.36-150700.3.24.1
fixed
suse enterprise server 15 SP6
8.2.35-150600.3.39.1
fixed
suse enterprise server 15 SP7
8.3.36-150700.3.24.1
fixed
php8-iconv
suse enterprise sap 15 SP6
8.2.35-150600.3.39.1
fixed
suse enterprise sap 15 SP7
8.3.36-150700.3.24.1
fixed
suse enterprise server 15 SP6
8.2.35-150600.3.39.1
fixed
suse enterprise server 15 SP7
8.3.36-150700.3.24.1
fixed
php8-intl
suse enterprise sap 15 SP6
8.2.35-150600.3.39.1
fixed
suse enterprise sap 15 SP7
8.3.36-150700.3.24.1
fixed
suse enterprise server 15 SP6
8.2.35-150600.3.39.1
fixed
suse enterprise server 15 SP7
8.3.36-150700.3.24.1
fixed
php8-ldap
suse enterprise sap 15 SP6
8.2.35-150600.3.39.1
fixed
suse enterprise sap 15 SP7
8.3.36-150700.3.24.1
fixed
suse enterprise server 15 SP6
8.2.35-150600.3.39.1
fixed
suse enterprise server 15 SP7
8.3.36-150700.3.24.1
fixed
php8-mbstring
suse enterprise sap 15 SP6
8.2.35-150600.3.39.1
fixed
suse enterprise sap 15 SP7
8.3.36-150700.3.24.1
fixed
suse enterprise server 15 SP6
8.2.35-150600.3.39.1
fixed
suse enterprise server 15 SP7
8.3.36-150700.3.24.1
fixed
php8-mysql
suse enterprise sap 15 SP6
8.2.35-150600.3.39.1
fixed
suse enterprise sap 15 SP7
8.3.36-150700.3.24.1
fixed
suse enterprise server 15 SP6
8.2.35-150600.3.39.1
fixed
suse enterprise server 15 SP7
8.3.36-150700.3.24.1
fixed
php8-odbc
suse enterprise sap 15 SP6
8.2.35-150600.3.39.1
fixed
suse enterprise sap 15 SP7
8.3.36-150700.3.24.1
fixed
suse enterprise server 15 SP6
8.2.35-150600.3.39.1
fixed
suse enterprise server 15 SP7
8.3.36-150700.3.24.1
fixed
php8-opcache
suse enterprise sap 15 SP6
8.2.35-150600.3.39.1
fixed
suse enterprise sap 15 SP7
8.3.36-150700.3.24.1
fixed
suse enterprise server 15 SP6
8.2.35-150600.3.39.1
fixed
suse enterprise server 15 SP7
8.3.36-150700.3.24.1
fixed
php8-openssl
suse enterprise sap 15 SP6
8.2.35-150600.3.39.1
fixed
suse enterprise sap 15 SP7
8.3.36-150700.3.24.1
fixed
suse enterprise server 15 SP6
8.2.35-150600.3.39.1
fixed
suse enterprise server 15 SP7
8.3.36-150700.3.24.1
fixed
php8-pcntl
suse enterprise sap 15 SP6
8.2.35-150600.3.39.1
fixed
suse enterprise sap 15 SP7
8.3.36-150700.3.24.1
fixed
suse enterprise server 15 SP6
8.2.35-150600.3.39.1
fixed
suse enterprise server 15 SP7
8.3.36-150700.3.24.1
fixed
php8-pdo
suse enterprise sap 15 SP6
8.2.35-150600.3.39.1
fixed
suse enterprise sap 15 SP7
8.3.36-150700.3.24.1
fixed
suse enterprise server 15 SP6
8.2.35-150600.3.39.1
fixed
suse enterprise server 15 SP7
8.3.36-150700.3.24.1
fixed
php8-pgsql
suse enterprise sap 15 SP6
8.2.35-150600.3.39.1
fixed
suse enterprise sap 15 SP7
8.3.36-150700.3.24.1
fixed
suse enterprise server 15 SP6
8.2.35-150600.3.39.1
fixed
suse enterprise server 15 SP7
8.3.36-150700.3.24.1
fixed
php8-phar
suse enterprise sap 15 SP6
8.2.35-150600.3.39.1
fixed
suse enterprise sap 15 SP7
8.3.36-150700.3.24.1
fixed
suse enterprise server 15 SP6
8.2.35-150600.3.39.1
fixed
suse enterprise server 15 SP7
8.3.36-150700.3.24.1
fixed
php8-posix
suse enterprise sap 15 SP6
8.2.35-150600.3.39.1
fixed
suse enterprise sap 15 SP7
8.3.36-150700.3.24.1
fixed
suse enterprise server 15 SP6
8.2.35-150600.3.39.1
fixed
suse enterprise server 15 SP7
8.3.36-150700.3.24.1
fixed
php8-readline
suse enterprise sap 15 SP6
8.2.35-150600.3.39.1
fixed
suse enterprise sap 15 SP7
8.3.36-150700.3.24.1
fixed
suse enterprise server 15 SP6
8.2.35-150600.3.39.1
fixed
suse enterprise server 15 SP7
8.3.36-150700.3.24.1
fixed
php8-shmop
suse enterprise sap 15 SP6
8.2.35-150600.3.39.1
fixed
suse enterprise sap 15 SP7
8.3.36-150700.3.24.1
fixed
suse enterprise server 15 SP6
8.2.35-150600.3.39.1
fixed
suse enterprise server 15 SP7
8.3.36-150700.3.24.1
fixed
php8-snmp
suse enterprise sap 15 SP6
8.2.35-150600.3.39.1
fixed
suse enterprise sap 15 SP7
8.3.36-150700.3.24.1
fixed
suse enterprise server 15 SP6
8.2.35-150600.3.39.1
fixed
suse enterprise server 15 SP7
8.3.36-150700.3.24.1
fixed
php8-soap
suse enterprise sap 15 SP6
8.2.35-150600.3.39.1
fixed
suse enterprise sap 15 SP7
8.3.36-150700.3.24.1
fixed
suse enterprise server 15 SP6
8.2.35-150600.3.39.1
fixed
suse enterprise server 15 SP7
8.3.36-150700.3.24.1
fixed
php8-sockets
suse enterprise sap 15 SP6
8.2.35-150600.3.39.1
fixed
suse enterprise sap 15 SP7
8.3.36-150700.3.24.1
fixed
suse enterprise server 15 SP6
8.2.35-150600.3.39.1
fixed
suse enterprise server 15 SP7
8.3.36-150700.3.24.1
fixed
php8-sodium
suse enterprise sap 15 SP6
8.2.35-150600.3.39.1
fixed
suse enterprise sap 15 SP7
8.3.36-150700.3.24.1
fixed
suse enterprise server 15 SP6
8.2.35-150600.3.39.1
fixed
suse enterprise server 15 SP7
8.3.36-150700.3.24.1
fixed
php8-sqlite
suse enterprise sap 15 SP6
8.2.35-150600.3.39.1
fixed
suse enterprise sap 15 SP7
8.3.36-150700.3.24.1
fixed
suse enterprise server 15 SP6
8.2.35-150600.3.39.1
fixed
suse enterprise server 15 SP7
8.3.36-150700.3.24.1
fixed
php8-sysvmsg
suse enterprise sap 15 SP6
8.2.35-150600.3.39.1
fixed
suse enterprise sap 15 SP7
8.3.36-150700.3.24.1
fixed
suse enterprise server 15 SP6
8.2.35-150600.3.39.1
fixed
suse enterprise server 15 SP7
8.3.36-150700.3.24.1
fixed
php8-sysvsem
suse enterprise sap 15 SP6
8.2.35-150600.3.39.1
fixed
suse enterprise sap 15 SP7
8.3.36-150700.3.24.1
fixed
suse enterprise server 15 SP6
8.2.35-150600.3.39.1
fixed
suse enterprise server 15 SP7
8.3.36-150700.3.24.1
fixed
php8-sysvshm
suse enterprise sap 15 SP6
8.2.35-150600.3.39.1
fixed
suse enterprise sap 15 SP7
8.3.36-150700.3.24.1
fixed
suse enterprise server 15 SP6
8.2.35-150600.3.39.1
fixed
suse enterprise server 15 SP7
8.3.36-150700.3.24.1
fixed
php8-test
suse enterprise sap 15 SP6
8.2.35-150600.3.39.1
fixed
suse enterprise sap 15 SP7
8.3.36-150700.3.24.1
fixed
suse enterprise server 15 SP6
8.2.35-150600.3.39.1
fixed
suse enterprise server 15 SP7
8.3.36-150700.3.24.1
fixed
php8-tidy
suse enterprise sap 15 SP6
8.2.35-150600.3.39.1
fixed
suse enterprise sap 15 SP7
8.3.36-150700.3.24.1
fixed
suse enterprise server 15 SP6
8.2.35-150600.3.39.1
fixed
suse enterprise server 15 SP7
8.3.36-150700.3.24.1
fixed
php8-tokenizer
suse enterprise sap 15 SP6
8.2.35-150600.3.39.1
fixed
suse enterprise sap 15 SP7
8.3.36-150700.3.24.1
fixed
suse enterprise server 15 SP6
8.2.35-150600.3.39.1
fixed
suse enterprise server 15 SP7
8.3.36-150700.3.24.1
fixed
php8-xmlreader
suse enterprise sap 15 SP6
8.2.35-150600.3.39.1
fixed
suse enterprise sap 15 SP7
8.3.36-150700.3.24.1
fixed
suse enterprise server 15 SP6
8.2.35-150600.3.39.1
fixed
suse enterprise server 15 SP7
8.3.36-150700.3.24.1
fixed
php8-xmlwriter
suse enterprise sap 15 SP6
8.2.35-150600.3.39.1
fixed
suse enterprise sap 15 SP7
8.3.36-150700.3.24.1
fixed
suse enterprise server 15 SP6
8.2.35-150600.3.39.1
fixed
suse enterprise server 15 SP7
8.3.36-150700.3.24.1
fixed
php8-xsl
suse enterprise sap 15 SP6
8.2.35-150600.3.39.1
fixed
suse enterprise sap 15 SP7
8.3.36-150700.3.24.1
fixed
suse enterprise server 15 SP6
8.2.35-150600.3.39.1
fixed
suse enterprise server 15 SP7
8.3.36-150700.3.24.1
fixed
php8-zip
suse enterprise sap 15 SP6
8.2.35-150600.3.39.1
fixed
suse enterprise sap 15 SP7
8.3.36-150700.3.24.1
fixed
suse enterprise server 15 SP6
8.2.35-150600.3.39.1
fixed
suse enterprise server 15 SP7
8.3.36-150700.3.24.1
fixed
php8-zlib
suse enterprise sap 15 SP6
8.2.35-150600.3.39.1
fixed
suse enterprise sap 15 SP7
8.3.36-150700.3.24.1
fixed
suse enterprise server 15 SP6
8.2.35-150600.3.39.1
fixed
suse enterprise server 15 SP7
8.3.36-150700.3.24.1
fixed
Red Hat logo
Red Hat Enterprise Linux Releases
Red Hat Product
Release
php
RHEL 9
0:8.0.30-8.el9_8.1
fixed
php-bcmath
RHEL 9
0:8.0.30-8.el9_8.1
fixed
php-cli
RHEL 9
0:8.0.30-8.el9_8.1
fixed
php-common
RHEL 9
0:8.0.30-8.el9_8.1
fixed
php-dba
RHEL 9
0:8.0.30-8.el9_8.1
fixed
php-dbg
RHEL 9
0:8.0.30-8.el9_8.1
fixed
php-devel
RHEL 9
0:8.0.30-8.el9_8.1
fixed
php-embedded
RHEL 9
0:8.0.30-8.el9_8.1
fixed
php-enchant
RHEL 9
0:8.0.30-8.el9_8.1
fixed
php-ffi
RHEL 9
0:8.0.30-8.el9_8.1
fixed
php-fpm
RHEL 9
0:8.0.30-8.el9_8.1
fixed
php-gd
RHEL 9
0:8.0.30-8.el9_8.1
fixed
php-gmp
RHEL 9
0:8.0.30-8.el9_8.1
fixed
php-intl
RHEL 9
0:8.0.30-8.el9_8.1
fixed
php-ldap
RHEL 9
0:8.0.30-8.el9_8.1
fixed
php-mbstring
RHEL 9
0:8.0.30-8.el9_8.1
fixed
php-mysqlnd
RHEL 9
0:8.0.30-8.el9_8.1
fixed
php-odbc
RHEL 9
0:8.0.30-8.el9_8.1
fixed
php-opcache
RHEL 9
0:8.0.30-8.el9_8.1
fixed
php-pdo
RHEL 9
0:8.0.30-8.el9_8.1
fixed
php-pgsql
RHEL 9
0:8.0.30-8.el9_8.1
fixed
php-process
RHEL 9
0:8.0.30-8.el9_8.1
fixed
php-snmp
RHEL 9
0:8.0.30-8.el9_8.1
fixed
php-soap
RHEL 9
0:8.0.30-8.el9_8.1
fixed
php-xml
RHEL 9
0:8.0.30-8.el9_8.1
fixed
Common Weakness Enumeration
Vulnerability Media Exposure
References
https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp
http://www.openwall.com/lists/oss-security/2026/10/21/16
http://www.openwall.com/lists/oss-security/2026/10/21/17
http://www.openwall.com/lists/oss-security/2026/10/21/23
http://www.openwall.com/lists/oss-security/2026/10/21/7
http://www.openwall.com/lists/oss-security/2026/10/22/2
https://www.wiz.io/blog/php2shell-php-rce