CVE-2026-109619 PUBLISHED

RCE via stale global state

Assigner: php
Reserved: 12.10.2026 Published: 21.10.2026 Updated: 21.10.2026

PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may read or branch on this stale state before it is fully initialized. Multiple strategies can trigger this condition and produce remote code execution (RCE).

Metrics

CVSS 4.0

CVSS Vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CVSS Score: 9.2

Exploitability Metrics		Vulnerable System Impact Metrics		Subsequent System Impact Metrics
Attack Vector	Network	Confidentiality	High	Confidentiality	None
Attack Complexity	High	Integrity	High	Integrity	None
Attack Requirements	Present	Availability	High	Availability	None
Privileges Required	None
User Interaction	None

CVSS 4.0

Product Status

Vendor	PHP Group
Product	PHP
Versions	Default: unaffected affected from 8.2.* to 8.2.35 (excl.) affected from 8.3.* to 8.3.36 (excl.) affected from 8.4.* to 8.4.27 (excl.) affected from 8.5.* to 8.5.12 (excl.)

Workarounds

Check the GitHub Security Advisory for mitigation strategies.

Credits

Wiz reporter
Ryan at Calif.io reporter
OpenAI reporter
Arnaud Le Blanc remediation developer
Ilija Tovilo remediation developer
Jakub Zelenka remediation developer
Nora Dossche remediation developer

References

https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp

Problem Types

CWE-416 Use after free CWE
CWE-755 Improper Handling of Exceptional Conditions CWE
CWE-824 Access of uninitialized pointer CWE
CWE-1325 Improperly controlled sequential memory allocation CWE
CWE-1419 Incorrect Initialization of Resource CWE

Impacts

CAPEC-234 Hijacking a privileged process