Use After Free in PHP
CVE-2026-109619
PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may read or branch on this stale state before it is fully initialized. Multiple strategies can trigger this condition and produce remote code execution (RCE).
Vulnerability class: Use-After-Free
Published · last modified .
CVSS v3 metric
CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
EPSS exploit prediction
No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.
Affected products
Weakness classification (CWE)
References
- github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp (vendor-advisory, Mitigation, Vendor Advisory)
- 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Third Party Advisory)
- af854a3a-2127-422b-91ae-364da2661108
- af854a3a-2127-422b-91ae-364da2661108
- af854a3a-2127-422b-91ae-364da2661108
Frequently asked questions
- What is CVE-2026-109619?
- CVE-2026-109619 is a critical-severity vulnerability in PHP, classified under Use After Free. CVSS score: 9.8/10. Published 2026-10-21.
- How severe is CVE-2026-109619?
- Critical severity. CVSS v3 base score is 9.8 out of 10.