CVE-2026-109619

A flaw was found in PHP's error handling and worker process state management. PHP contains error handling, object, and extension state that is retained by the process but points to memory owned by a single request. A fatal error can interrupt an operation or cleanup phase before that state is reset. If PHP catches the failure and continues cleanup, or reuses the persistent worker for a subsequent request, a later operation may act on the stale state after its underlying memory has been released. An unauthenticated attacker can exploit this to achieve use-after-free and remote code execution against mod_php. FPM is conditionally affected through application-stage paths.

An unauthenticated remote attacker can trigger memory corruption leading to potential arbitrary code execution. In typical Red Hat Enterprise Linux deployments, PHP applications exposed to public networks handle incoming requests directly, so no prior authentication is needed to reach the vulnerable code. Exploitation requires hitting a precise out-of-memory condition during request processing, which keeps this below Critical.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

See the security bulletin for a detailed mitigation procedure.