A critical memory-safety flaw in PHP lets stale global state point into freed request memory, which can be triggered to achieve remote code execution on PHP 8.2 through 8.5.
What Is It
CVE-2026-109619 is a vulnerability in PHP (php-src), reported by the PHP Group. PHP keeps various pieces of global state that temporarily point into request memory. In some scenarios, that state is not reset correctly, or it is filled in again after being reset. It can then still refer to request memory after that memory has been freed. Later requests may read or branch on this stale state before it is fully initialized. According to the advisory, several different strategies can trigger this condition and produce remote code execution (RCE).
The PHP Group mapped the flaw to CWE-416 (Use After Free), CWE-755 (Improper Handling of Exceptional Conditions), CWE-824 (Access of Uninitialized Pointer), and CWE-1325 (Improperly Controlled Sequential Memory Allocation).
Why It Matters
NVD rates the flaw 9.8 CRITICAL under CVSS 3.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H): it is network-reachable and needs no privileges or user interaction. The PHP Group's own CVSS 4.0 score is 9.2 CRITICAL, but it rates attack complexity as high and says certain attack requirements must be present (AC:H/AT:P). Both scores agree that a successful attack has a high impact on confidentiality, integrity, and availability.
The flaw is not currently listed in CISA's Known Exploited Vulnerabilities (KEV) catalog. CISA's SSVC assessment records exploitation as "none," automatable as "no," and technical impact as "total." The supplied data does not confirm any active exploitation.
What's Vulnerable
According to the PHP Group (CNA), the following PHP releases are affected:
- PHP 8.2.x before 8.2.35
- PHP 8.3.x before 8.3.36
- PHP 8.4.x before 8.4.27
- PHP 8.5.x before 8.5.12
NVD's CPE configuration lists the first range as all PHP versions before 8.2.35, with no lower bound. That means NVD treats builds older than the 8.2 branch as vulnerable too.
Patch Status
Fixed releases are available on every affected branch: 8.2.35, 8.3.36, 8.4.27, and 8.5.12. Upgrade PHP to the fixed release for your branch. The PHP Group's GitHub security advisory (GHSA-6wmf-4rv5-p3rp) is tagged as a vendor advisory with mitigation information, so check it for further guidance. There is no CISA KEV entry, so no federal required-action deadline applies.