A critical flaw in how PHP handles out-of-memory errors can leave request memory uninitialized. According to the PHP security team, attackers may be able to trigger it to achieve remote code execution on affected PHP 8.2 through 8.5 builds. How reliably it can be exploited in real deployments is not yet clear.
What Is It
PHP uses longjmp() to exit the current context and abort request handling when it hits an out-of-memory (OOM) error. According to the PHP security team's description, some contexts do not account for this. They can leave request memory uninitialized before an allocation happens. The request cleanup routine that runs afterward may then read or branch on that uninitialized memory.
The advisory states that multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE). The PHP CNA classifies the weakness under CWE-416 (Use After Free), CWE-755 (Improper Handling of Exceptional Conditions), CWE-824 (Access of Uninitialized Pointer), and CWE-1325 (Improperly Controlled Sequential Memory Allocation).
Why It Matters
NVD rates this flaw CVSS 3.1 9.8 (Critical) with vector AV:N/AC:L/PR:N/UI:N. That means it is network-reachable, needs no privileges or user interaction, and has high impact on confidentiality, integrity, and availability. The PHP CNA's CVSS 4.0 score is 9.2 (Critical). It rates attack complexity as high and lists attack requirements as present.
PHP is the runtime underneath a large share of web applications. Because the flaw is in the interpreter itself, applications running on vulnerable builds may be exposed. Whether a specific application can actually be exploited likely depends on whether an attacker can drive it into the required out-of-memory conditions.
As of publication, this CVE is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, so KEV does not confirm active exploitation. CISA's SSVC assessment records exploitation as "none", automatable as "no", and technical impact as "total".
What's Vulnerable
PHP (php-src) branches listed by the PHP Group:
- 8.2.x before 8.2.35
- 8.3.x before 8.3.36
- 8.4.x before 8.4.27
- 8.5.x before 8.5.12
NVD's CPE configuration marks all PHP versions before 8.2.35 as vulnerable, not just the 8.2 branch. Teams running older, end-of-life PHP releases should treat those versions as in scope.
Patch Status
The affected-version boundaries show fixes in PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12. Upgrade to the fixed release on your branch. The PHP GitHub security advisory (GHSA-w8hw-w9fx-j79w) is tagged as a vendor advisory with mitigation guidance. Review it for interim measures if you cannot upgrade right away.
There is no KEV entry, so no CISA remediation due date or required action applies at this time.