PHP: uninitialized memory on OOM longjmp leads to remote code execution, in CISA KEV

Impact

PHP aborts a request on out-of-memory with longjmp(), and some contexts leave request memory uninitialized before the next allocation; the cleanup path then reads or branches on that memory. Several OOM strategies reach the condition reliably and the advisory states it leads to remote code execution. This is listed in CISA KEV, so exploitation is already observed. For a GPU datacenter the exposure is the surrounding infrastructure rather than the accelerators: PHP-FPM behind any operator-facing web surface - dashboards, ticketing, billing or vendor appliance management interfaces - gives a remote attacker code execution as the web worker, and Siemens confirms the issue in RUGGEDCOM APE1808 firmware, a device class that shows up in datacenter and facility networks.

Who can reach it

Remote and unauthenticated against any PHP endpoint where an attacker can drive the process to its memory limit; attack complexity is rated high and exploitation depends on the OOM strategy reached.

What to do

Apply the patched PHP release from the php-src advisory to every PHP install and restart PHP-FPM or the web server; distribution packages carry the same fix. For Siemens RUGGEDCOM APE1808, follow SSA-566512 - that path means an appliance firmware update with the device out of service. KEV listing makes this urgent rather than scheduled.

References

Related entries

• Brotli: out-of-bounds write in the decoder allows remote unauthenticated code executionCVE-2026-111497 · Google Brotli decoder (c/dec/decode.c)Critical
• glibc: wordexp() reads out of bounds on a crafted pattern, crashing or leaking memoryCVE-2021-35942 · GNU C Library (glibc) wordexp() parameter parsingCritical
• Linux kernel SMC-R/SMC-D (CLC proposal parsing, iparea_offset / ipv6_prefixes_cnt): Third instance of the same class inCVE-2024-49571 · Linux kernel SMC-R/SMC-D (CLC proposal parsing, iparea_offset / ipv6_prefixes_cnt)Critical
• OpenSSL: SSL_select_next_proto() over-reads and can send up to 255 bytes of process memory to the peerCVE-2024-5535 · OpenSSL SSL_select_next_proto() (ALPN/NPN protocol negotiation)Critical
• LXD: incomplete low-level denylist lets a restricted-project VM editor reach host rootCVE-2026-34177 · Canonical LXD (restricted.virtual-machines.lowlevel denylist: raw.apparmor, raw.qemu.conf)Critical
• Go x/crypto ssh/agent: destination restrictions silently dropped when adding keys to a remote agentCVE-2026-39832 · golang.org/x/crypto/ssh/agent (constraint extension serialization)Critical