Common Weakness Enumeration
CWE-416
AllowedUse After Free
Abstraction: Variant · Status: Stable
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
3573 vulnerabilities reference this CWE, most recent first.
CVE-2026-112094 (GCVE-0-2026-112094)
Vulnerability from cvelistv5 – Published: 2026-10-19 08:00 – Updated: 2026-10-19 17:23
VLAI
EPSS
VEX
Title
michaelrsweet mxml mxml-file.c mxml_load_data use after free
Summary
A security vulnerability has been detected in michaelrsweet mxml 4.0.5/4.0.6. This affects the function mxml_load_data of the file mxml-file.c. The manipulation leads to use after free. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-19 17:23 UTC
Assigner
VulDB
CNA
References
8 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/421908 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/421908/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-112094 | third-party-advisory |
| https://vuldb.com/submit/1011796 | third-party-advisory |
| https://github.com/michaelrsweet/mxml/issues/358 | issue-tracking |
| https://github.com/user-attachments/files/3283654… | patch |
| https://github.com/user-attachments/files/3270182… | exploit |
| https://github.com/michaelrsweet/mxml/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| michaelrsweet | mxml |
Affected:
4.0.5
Affected: 4.0.6 cpe:2.3:a:michaelrsweet:mxml:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-112094",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-19T17:23:40.326470Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T17:23:50.222Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:michaelrsweet:mxml:*:*:*:*:*:*:*:*"
],
"product": "mxml",
"vendor": "michaelrsweet",
"versions": [
{
"status": "affected",
"version": "4.0.5"
},
{
"status": "affected",
"version": "4.0.6"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "suyuanwang (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A security vulnerability has been detected in michaelrsweet mxml 4.0.5/4.0.6. This affects the function mxml_load_data of the file mxml-file.c. The manipulation leads to use after free. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 6.5,
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "Use After Free",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-119",
"description": "Memory Corruption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T08:00:22.009Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-421908 | michaelrsweet mxml mxml-file.c mxml_load_data use after free",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/421908"
},
{
"name": "VDB-421908 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/421908/cti"
},
{
"name": "CVE-2026-112094 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-112094"
},
{
"name": "Submit #1011796 | mxml v4.0.5, v4.0.6 Use After Free",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/1011796"
},
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/michaelrsweet/mxml/issues/358"
},
{
"tags": [
"patch"
],
"url": "https://github.com/user-attachments/files/32836547/mxml-fix-354-358.patch"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/user-attachments/files/32701825/poc_mxml_error_handling.tar.gz"
},
{
"tags": [
"product"
],
"url": "https://github.com/michaelrsweet/mxml/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-10-18T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-10-18T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-10-18T19:10:13.000Z",
"value": "VulDB entry last update"
}
],
"title": "michaelrsweet mxml mxml-file.c mxml_load_data use after free",
"x_generator": [
"VulDB PVTS v202610"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-112094",
"datePublished": "2026-10-19T08:00:22.009Z",
"dateReserved": "2026-10-18T17:05:08.771Z",
"dateUpdated": "2026-10-19T17:23:50.222Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-111804 (GCVE-0-2026-111804)
Vulnerability from cvelistv5 – Published: 2026-10-21 18:21 – Updated: 2026-10-23 21:23
VLAI
EPSS
VEX
Title
Apache Traffic Server: wasm plugin has a use-after-free and forwards unvalidated guest metric IDs
Summary
Apache Traffic Server's experimental wasm plugin has a use-after-free in its transaction-close handler and forwards unvalidated guest-supplied metric IDs to the internal stats API.
This issue affects Apache Traffic Server: from 10.0.0 through 10.1.4, 10.2.0.
Users are recommended to upgrade to version 10.1.5 or 10.2.1, which fix the issue.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-23 20:52 UTC
CWE
- CWE-416 - Use After Free
Assigner
apache
CNA
References
1 reference
| URL | Tags |
|---|---|
| https://lists.apache.org/thread/r95dq29ywcd1f4x30… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Apache Software Foundation | Apache Traffic Server |
Affected:
10.0.0 , ≤ 10.1.4
(semver)
Affected: 10.2.0 (semver) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-111804",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-23T20:52:13.262806Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-23T21:23:16.760Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Apache Traffic Server",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThanOrEqual": "10.1.4",
"status": "affected",
"version": "10.0.0",
"versionType": "semver"
},
{
"status": "affected",
"version": "10.2.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Omkhar Arasaratnam"
},
{
"lang": "en",
"type": "reporter",
"value": "Apache Community"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eApache Traffic Server\u0027s experimental wasm plugin has a use-after-free in its transaction-close handler and forwards unvalidated guest-supplied metric IDs to the internal stats API.\u003c/p\u003e\u003cp\u003eThis issue affects Apache Traffic Server: from 10.0.0 through 10.1.4, 10.2.0.\u003c/p\u003e\u003cp\u003eUsers are recommended to upgrade to version 10.1.5 or 10.2.1, which fix the issue.\u003c/p\u003e"
}
],
"value": "Apache Traffic Server\u0027s experimental wasm plugin has a use-after-free in its transaction-close handler and forwards unvalidated guest-supplied metric IDs to the internal stats API.\n\n\n\nThis issue affects Apache Traffic Server: from 10.0.0 through 10.1.4, 10.2.0.\n\n\n\nUsers are recommended to upgrade to version 10.1.5 or 10.2.1, which fix the issue."
}
],
"metrics": [
{
"other": {
"content": {
"text": "critical"
},
"type": "Textual description of severity"
},
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "CWE-416 Use After Free",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T18:21:32.055Z",
"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"shortName": "apache"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://lists.apache.org/thread/r95dq29ywcd1f4x30snxlqmb12z4s4kc"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Apache Traffic Server: wasm plugin has a use-after-free and forwards unvalidated guest metric IDs",
"x_generator": {
"engine": "scripts/cve_render.py"
}
}
},
"cveMetadata": {
"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"assignerShortName": "apache",
"cveId": "CVE-2026-111804",
"datePublished": "2026-10-21T18:21:32.055Z",
"dateReserved": "2026-10-16T20:15:36.197Z",
"dateUpdated": "2026-10-23T21:23:16.760Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-110753 (GCVE-0-2026-110753)
Vulnerability from cvelistv5 – Published: 2026-10-16 22:06 – Updated: 2026-10-20 18:14
VLAI
EPSS
VEX
Title
Text::CSV_XS versions from 1.46 before 1.65 for Perl have a use-after-free of bind_columns variables when skip_empty_rows skips an empty line in getline
Summary
Text::CSV_XS versions from 1.46 before 1.65 for Perl have a use-after-free of bind_columns variables when skip_empty_rows skips an empty line in getline.
With bind_columns, the parser writes each field into the caller's own scalar without taking a reference to it. When skip_empty_rows skips an empty last line, the parser frees the current field scalar without checking whether it is bound, dropping one reference from the application's variable. The "eof" mode does the same on any empty line.
The variable is then freed while the application still references it, so later code uses freed memory and can crash the process.
Severity
9.8 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-20 18:14 UTC
Assigner
CPANSec
CNA
References
2 references
| URL | Tags |
|---|---|
| https://github.com/cpan-authors/Text-CSV_XS/commi… | patch |
| https://metacpan.org/release/HMBRAND/Text-CSV_XS-… | release-notes |
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-110753",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-20T18:14:16.549927Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-20T18:14:23.696Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://cpan.org/modules",
"defaultStatus": "unaffected",
"modules": [
"Text::CSV_XS"
],
"packageName": "Text-CSV_XS",
"packageURL": "pkg:cpan/Text-CSV_XS",
"programFiles": [
"CSV_XS.xs"
],
"programRoutines": [
{
"name": "Text::CSV_XS::getline"
}
],
"repo": "https://github.com/cpan-authors/Text-CSV_XS",
"versions": [
{
"lessThan": "1.65",
"status": "affected",
"version": "1.46",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Text::CSV_XS versions from 1.46 before 1.65 for Perl have a use-after-free of bind_columns variables when skip_empty_rows skips an empty line in getline.\n\nWith bind_columns, the parser writes each field into the caller\u0027s own scalar without taking a reference to it. When skip_empty_rows skips an empty last line, the parser frees the current field scalar without checking whether it is bound, dropping one reference from the application\u0027s variable. The \"eof\" mode does the same on any empty line.\n\nThe variable is then freed while the application still references it, so later code uses freed memory and can crash the process."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "CWE-416 Use After Free",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-911",
"description": "CWE-911 Improper Update of Reference Count",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T22:06:23.680Z",
"orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
"shortName": "CPANSec"
},
"references": [
{
"tags": [
"patch"
],
"url": "https://github.com/cpan-authors/Text-CSV_XS/commit/f082d5c8aab1b8d16b6181d4f3042a06947e260f.patch"
},
{
"tags": [
"release-notes"
],
"url": "https://metacpan.org/release/HMBRAND/Text-CSV_XS-1.65/changes"
}
],
"solutions": [
{
"lang": "en",
"value": "Upgrade to Text-CSV_XS 1.65 or later."
}
],
"source": {
"discovery": "UNKNOWN"
},
"timeline": [
{
"lang": "en",
"time": "2026-10-14T00:00:00.000Z",
"value": "Fix committed to upstream repository."
},
{
"lang": "en",
"time": "2026-10-15T00:00:00.000Z",
"value": "Version 1.65 released with fix."
}
],
"title": "Text::CSV_XS versions from 1.46 before 1.65 for Perl have a use-after-free of bind_columns variables when skip_empty_rows skips an empty line in getline",
"x_generator": {
"engine": "cpansec-cna-tool 0.1"
}
}
},
"cveMetadata": {
"assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
"assignerShortName": "CPANSec",
"cveId": "CVE-2026-110753",
"datePublished": "2026-10-16T22:06:23.680Z",
"dateReserved": "2026-10-14T17:06:13.039Z",
"dateUpdated": "2026-10-20T18:14:23.696Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-110686 (GCVE-0-2026-110686)
Vulnerability from cvelistv5 – Published: 2026-10-19 18:12 – Updated: 2026-10-29 17:11
VLAI
EPSS
VEX
Title
Cpanel::JSON::XS versions before 4.80 for Perl use freed filter callbacks when a filter removes itself during decoding in decode_hv
Summary
Cpanel::JSON::XS versions before 4.80 for Perl use freed filter callbacks when a filter removes itself during decoding in decode_hv.
A decode copies the parser's filter_json_object and filter_json_single_key_object callbacks without taking references to them. A filter callback that removes the last single-key filter frees the callback table while the decode in progress still uses it. The next object is dispatched through freed memory and can crash the process.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-29 17:11 UTC
CWE
- CWE-416 - Use After Free
Assigner
CPANSec
CNA
References
2 references
| URL | Tags |
|---|---|
| https://github.com/rurban/Cpanel-JSON-XS/commit/c… | patch |
| https://metacpan.org/release/RURBAN/Cpanel-JSON-X… | release-notes |
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-110686",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-29T17:11:03.335947Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-29T17:11:22.136Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://cpan.org/modules",
"defaultStatus": "unaffected",
"modules": [
"Cpanel::JSON::XS"
],
"packageName": "Cpanel-JSON-XS",
"packageURL": "pkg:cpan/Cpanel-JSON-XS",
"programFiles": [
"XS.xs"
],
"programRoutines": [
{
"name": "decode_hv"
},
{
"name": "decode_json"
}
],
"repo": "https://github.com/rurban/Cpanel-JSON-XS",
"versions": [
{
"lessThan": "4.80",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Cpanel::JSON::XS versions before 4.80 for Perl use freed filter callbacks when a filter removes itself during decoding in decode_hv.\n\nA decode copies the parser\u0027s filter_json_object and filter_json_single_key_object callbacks without taking references to them. A filter callback that removes the last single-key filter frees the callback table while the decode in progress still uses it. The next object is dispatched through freed memory and can crash the process."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "CWE-416 Use After Free",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T18:12:19.804Z",
"orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
"shortName": "CPANSec"
},
"references": [
{
"tags": [
"patch"
],
"url": "https://github.com/rurban/Cpanel-JSON-XS/commit/c3e7e3c5b0b72d82b072c6a7cfb8c34cec4c7ea2.patch"
},
{
"tags": [
"release-notes"
],
"url": "https://metacpan.org/release/RURBAN/Cpanel-JSON-XS-4.80/changes"
}
],
"solutions": [
{
"lang": "en",
"value": "Upgrade to Cpanel-JSON-XS 4.80 or later."
}
],
"source": {
"discovery": "UNKNOWN"
},
"timeline": [
{
"lang": "en",
"time": "2026-10-14T00:00:00.000Z",
"value": "Version 4.80 released with fix."
}
],
"title": "Cpanel::JSON::XS versions before 4.80 for Perl use freed filter callbacks when a filter removes itself during decoding in decode_hv",
"x_generator": {
"engine": "cpansec-cna-tool 0.1"
}
}
},
"cveMetadata": {
"assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
"assignerShortName": "CPANSec",
"cveId": "CVE-2026-110686",
"datePublished": "2026-10-19T18:12:19.804Z",
"dateReserved": "2026-10-14T13:26:57.076Z",
"dateUpdated": "2026-10-29T17:11:22.136Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-110681 (GCVE-0-2026-110681)
Vulnerability from cvelistv5 – Published: 2026-10-19 18:12 – Updated: 2026-10-30 11:04
VLAI
EPSS
VEX
Title
Cpanel::JSON::XS versions before 4.80 for Perl use the parent interpreter's scalars from a parser object cloned into a new ithread
Summary
Cpanel::JSON::XS versions before 4.80 for Perl use the parent interpreter's scalars from a parser object cloned into a new ithread.
A parser object holds its callbacks and its incremental parse buffer as raw scalar pointers. When a thread is created, these are copied into the new interpreter unchanged, so the child's parser uses, and later frees, scalars that belong to the parent and may already have been freed there.
A parser created before a thread starts and used inside it can call freed callbacks, corrupt reference counts and crash the process.
Severity
8.1 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-30 11:04 UTC
CWE
- CWE-416 - Use After Free
Assigner
CPANSec
CNA
References
2 references
| URL | Tags |
|---|---|
| https://github.com/rurban/Cpanel-JSON-XS/commit/c… | patch |
| https://metacpan.org/release/RURBAN/Cpanel-JSON-X… | release-notes |
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-110681",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-30T11:04:37.574678Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T11:04:48.764Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://cpan.org/modules",
"defaultStatus": "unaffected",
"modules": [
"Cpanel::JSON::XS"
],
"packageName": "Cpanel-JSON-XS",
"packageURL": "pkg:cpan/Cpanel-JSON-XS",
"programFiles": [
"XS.xs"
],
"programRoutines": [
{
"name": "Cpanel::JSON::XS::new"
}
],
"repo": "https://github.com/rurban/Cpanel-JSON-XS",
"versions": [
{
"lessThan": "4.80",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Cpanel::JSON::XS versions before 4.80 for Perl use the parent interpreter\u0027s scalars from a parser object cloned into a new ithread.\n\nA parser object holds its callbacks and its incremental parse buffer as raw scalar pointers. When a thread is created, these are copied into the new interpreter unchanged, so the child\u0027s parser uses, and later frees, scalars that belong to the parent and may already have been freed there.\n\nA parser created before a thread starts and used inside it can call freed callbacks, corrupt reference counts and crash the process."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "CWE-416 Use After Free",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T18:12:05.543Z",
"orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
"shortName": "CPANSec"
},
"references": [
{
"tags": [
"patch"
],
"url": "https://github.com/rurban/Cpanel-JSON-XS/commit/c53eefbaa59c344abd4c71762118da04280987e8.patch"
},
{
"tags": [
"release-notes"
],
"url": "https://metacpan.org/release/RURBAN/Cpanel-JSON-XS-4.80/changes"
}
],
"solutions": [
{
"lang": "en",
"value": "Upgrade to Cpanel-JSON-XS 4.80 or later."
}
],
"source": {
"discovery": "UNKNOWN"
},
"timeline": [
{
"lang": "en",
"time": "2026-10-14T00:00:00.000Z",
"value": "Version 4.80 released with fix."
}
],
"title": "Cpanel::JSON::XS versions before 4.80 for Perl use the parent interpreter\u0027s scalars from a parser object cloned into a new ithread",
"x_generator": {
"engine": "cpansec-cna-tool 0.1"
}
}
},
"cveMetadata": {
"assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
"assignerShortName": "CPANSec",
"cveId": "CVE-2026-110681",
"datePublished": "2026-10-19T18:12:05.543Z",
"dateReserved": "2026-10-14T13:25:47.112Z",
"dateUpdated": "2026-10-30T11:04:48.764Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-109676 (GCVE-0-2026-109676)
Vulnerability from cvelistv5 – Published: 2026-10-13 13:27 – Updated: 2026-10-14 14:00
VLAI
EPSS
VEX
Title
FreeRDP 3.0.0-beta1 before 3.32.0 Use-After-Free via Smartcard Connect
Summary
FreeRDP from 3.0.0-beta1 before 3.32.0 contains a use-after-free vulnerability in smartcard handling that allows attackers to access a freed smartcard handle object after an invalid connect operation. Attackers can trigger an invalid smartcard connect operation to cause reuse of the freed handle, leading to memory corruption or crashes.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-14 13:59 UTC
CWE
- CWE-416 - Use After Free
Assigner
VulnCheck
CNA
References
2 references
| URL | Tags |
|---|---|
| https://github.com/FreeRDP/FreeRDP/security/advis… | vendor-advisory |
| https://www.vulncheck.com/advisories/freerdp-3.0.… | third-party-advisory |
Impacted products
Date Public
2026-09-29 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-109676",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-14T13:59:11.733165Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-14T14:00:09.112Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "FreeRDP",
"vendor": "FreeRDP",
"versions": [
{
"lessThan": "3.32.0",
"status": "affected",
"version": "3.0.0-beta1",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "3.32.0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:freerdp:freerdp:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.32.0",
"versionStartIncluding": "3.0.0-beta1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "alexdowad"
},
{
"lang": "en",
"type": "coordinator",
"value": "x30n"
}
],
"datePublic": "2026-09-29T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "FreeRDP from 3.0.0-beta1 before 3.32.0 contains a use-after-free vulnerability in smartcard handling that allows attackers to access a freed smartcard handle object after an invalid connect operation. Attackers can trigger an invalid smartcard connect operation to cause reuse of the freed handle, leading to memory corruption or crashes."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "Use After Free",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T13:27:05.624Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-369h-7h2p-4685)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-369h-7h2p-4685"
},
{
"name": "VulnCheck Advisory: FreeRDP 3.0.0-beta1 before 3.32.0 Use-After-Free via Smartcard Connect",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/freerdp-3.0.0-beta1-before-3.32.0-use-after-free-via-smartcard-connect"
}
],
"title": "FreeRDP 3.0.0-beta1 before 3.32.0 Use-After-Free via Smartcard Connect",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-109676",
"datePublished": "2026-10-13T13:27:05.624Z",
"dateReserved": "2026-10-12T21:08:17.598Z",
"dateUpdated": "2026-10-14T14:00:09.112Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-109619 (GCVE-0-2026-109619)
Vulnerability from cvelistv5 – Published: 2026-10-21 13:54 – Updated: 2026-11-05 18:17
VLAI
EPSS
VEX
Title
RCE via stale global state
Summary
PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may read or branch on this stale state before it is fully initialized. Multiple strategies can trigger this condition and produce remote code execution (RCE).
Severity
SSVC
Exploitation: active
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-21 00:00 UTC
CWE
Assigner
php
CNA
References
19 references
Impacted products
108 products
| Vendor | Product | Version | |
|---|---|---|---|
| PHP Group | PHP |
Affected:
8.2.* , < 8.2.35
(semver)
Affected: 8.3.* , < 8.3.36 (semver) Affected: 8.4.* , < 8.4.27 (semver) Affected: 8.5.* , < 8.5.12 (semver) |
|
| Siemens | AMIS TS |
Affected:
0 , < *
(custom)
|
|
| Siemens | AX4 |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | blueplanet 360 NX3 M6 WM OD IISX |
Affected:
0 , < *
(custom)
|
|
| Siemens | blueplanet 360 NX3 M6 WM OD IISX - S |
Affected:
0 , < *
(custom)
|
|
| Siemens | Building X |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | CADRA |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Call stations |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Capital |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Chargesight |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Climatix Cloud IC |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Climatix Devices |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Connect Insights |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Connect X200 |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Connect X300 |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Connect X500 |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | cRSP |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Depotfinity |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Designcenter |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Designcenter X |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Designcenter X Essentials |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Desigo CC |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Desigo DXR2 |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Desigo DXR3 |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Desigo Optic |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Desigo PXC3 |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Desigo PXC4 |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Desigo PXC5 |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Desigo PXC7 |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | DFMExpress |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Energy Engage V2.0SP9 |
Affected:
0 , < *
(custom)
|
|
| Siemens | Energy Engage V3.1SP1 |
Affected:
0 , < *
(custom)
|
|
| Siemens | Energy Management System |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Enlighted RTLS |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Enlighted Space |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Heliox Flex Pro |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Heliox H60 |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Heliox Rapid |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | HyperLynx |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Insights Hub |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Local Monitoring bt-monitoring-vm |
Affected:
0 , < V20261103
(custom)
|
|
| Siemens | Navigator E&S |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Novigo VANSYS |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Novigo VANSYS core |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Opcenter Connect Electronics |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Opcenter Connect MOM |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Opcenter Execution Core |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Opcenter Execution Discrete |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Opcenter Execution Foundation |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Opcenter Execution Pharma |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Opcenter Execution Process |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Opcenter Intelligence |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Opcenter Intra Plant Logistics |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Opcenter Quality |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Opcenter RDnL |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Opcenter X |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | PACE-Design |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | PADS Pro Essentials |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | PADS Pro Student Edition |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | PADS Professional |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | PADS Professional - XCR |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | PADS Standard - XCR |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | PADS Standard & Standard Plus |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Pathway to Learning Engineering |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Polarion |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | QuadView |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | RUGGEDCOM APE1808 |
Affected:
0 , < *
(custom)
|
|
| Siemens | Sicharge D |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Sicharge D Configuration Backend |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | SICHARGE FLEX |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | SICHARGE UC |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Sifinity Control |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Sifinity Go |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Sifinity Setup |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Simcenter Flomaster |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Simcenter Flux |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Simcenter Simlab |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Sinteso FS20 EN |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | SiPass integrated |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | SIPORT |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Siveillance Control |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Siveillance Control Pro |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Siveillance Intrusion |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Siveillance Video |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Solid Edge |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Spectrum Power 3 |
Affected:
0 , < *
(custom)
|
|
| Siemens | Spectrum Power 4 |
Affected:
0 , < *
(custom)
|
|
| Siemens | Spectrum Power 7 |
Affected:
0 , < *
(custom)
|
|
| Siemens | Spectrum Power TG |
Affected:
0 , < *
(custom)
|
|
| Siemens | Supply Chain Suite |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Teamcenter |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Teamcenter Product Cost Management |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Teamcenter Share |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Teamcenter Visualization |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Tecnomatix Plant Simulation |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | TestWay |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Valor NPI |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Verischarge |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | VersiCloudHeliox Dual Port 60kW |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Voice alarm panels |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Voice alarm systems and audio matrices |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Workplace Experience |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Xcargo |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Xpedition Designer |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Xpedition Enterprise |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Xpedition Enterprise XCR |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Xpedition IC Packaging |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Xpedition Layout Browser |
Unaffected:
0 , < *
(custom)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-109619",
"options": [
{
"Exploitation": "active"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-21T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
},
{
"other": {
"content": {
"dateAdded": "2026-10-26",
"reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-109619"
},
"type": "kev"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-28T03:55:47.838Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://www.wiz.io/blog/php2shell-php-rce"
},
{
"tags": [
"government-resource"
],
"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-109619"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://php2shell.delftintellab.com/"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://arcticwolf.com/resources/blog/php2shell-critical-php-vulnerabilities-enable-unauthenticated-remote-code-execution/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-10-26T00:00:00.000Z",
"value": "CVE-2026-109619 added to CISA KEV"
}
],
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2026-10-23T14:07:57.152Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://www.openwall.com/lists/oss-security/2026/10/21/7"
},
{
"url": "http://www.openwall.com/lists/oss-security/2026/10/21/16"
},
{
"url": "http://www.openwall.com/lists/oss-security/2026/10/21/17"
},
{
"url": "http://www.openwall.com/lists/oss-security/2026/10/21/23"
},
{
"url": "http://www.openwall.com/lists/oss-security/2026/10/22/2"
},
{
"url": "http://www.openwall.com/lists/oss-security/2026/10/22/14"
},
{
"url": "http://www.openwall.com/lists/oss-security/2026/10/22/15"
},
{
"url": "http://www.openwall.com/lists/oss-security/2026/10/22/16"
},
{
"url": "http://www.openwall.com/lists/oss-security/2026/10/22/19"
},
{
"url": "http://www.openwall.com/lists/oss-security/2026/10/22/20"
},
{
"url": "http://www.openwall.com/lists/oss-security/2026/10/23/4"
}
],
"title": "CVE Program Container"
},
{
"affected": [
{
"defaultStatus": "unknown",
"product": "AMIS TS",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "AX4",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "blueplanet 360 NX3 M6 WM OD IISX",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "blueplanet 360 NX3 M6 WM OD IISX - S",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Building X",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "CADRA",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Call stations",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Capital",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Chargesight",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Climatix Cloud IC",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Climatix Devices",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Connect Insights",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Connect X200",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Connect X300",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Connect X500",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "cRSP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Depotfinity",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Designcenter",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Designcenter X",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Designcenter X Essentials",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Desigo CC",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Desigo DXR2",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Desigo DXR3",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Desigo Optic",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Desigo PXC3",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Desigo PXC4",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Desigo PXC5",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Desigo PXC7",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "DFMExpress",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Energy Engage V2.0SP9",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Energy Engage V3.1SP1",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Energy Management System",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Enlighted RTLS",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Enlighted Space",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Heliox Flex Pro",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Heliox Flex Pro",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Heliox H60",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Heliox Rapid",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "HyperLynx",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Insights Hub",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Local Monitoring bt-monitoring-vm",
"vendor": "Siemens",
"versions": [
{
"lessThan": "V20261103",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Navigator E\u0026S",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Novigo VANSYS",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Novigo VANSYS core",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Opcenter Connect Electronics",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Opcenter Connect MOM",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Opcenter Execution Core",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Opcenter Execution Discrete",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Opcenter Execution Foundation",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Opcenter Execution Pharma",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Opcenter Execution Process",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Opcenter Intelligence",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Opcenter Intra Plant Logistics",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Opcenter Quality",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Opcenter RDnL",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Opcenter X",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "PACE-Design",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "PADS Pro Essentials",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "PADS Pro Student Edition",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "PADS Professional",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "PADS Professional - XCR",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "PADS Standard - XCR",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "PADS Standard \u0026 Standard Plus",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Pathway to Learning Engineering",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Polarion",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "QuadView",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "RUGGEDCOM APE1808",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Sicharge D",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Sicharge D Configuration Backend",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SICHARGE FLEX",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SICHARGE UC",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Sifinity Control",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Sifinity Go",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Sifinity Setup",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Simcenter Flomaster",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Simcenter Flux",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Simcenter Simlab",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Sinteso FS20 EN",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SiPass integrated",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIPORT",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Siveillance Control",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Siveillance Control Pro",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Siveillance Intrusion",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Siveillance Video",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Solid Edge",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Solid Edge",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Spectrum Power 3",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Spectrum Power 4",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Spectrum Power 4",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Spectrum Power 4",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Spectrum Power 7",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Spectrum Power TG",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Supply Chain Suite",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Teamcenter",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Teamcenter Product Cost Management",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Teamcenter Share",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Teamcenter Visualization",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Tecnomatix Plant Simulation",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "TestWay",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Valor NPI",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Verischarge",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "VersiCloudHeliox Dual Port 60kW",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Voice alarm panels",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Voice alarm systems and audio matrices",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Workplace Experience",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Xcargo",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Xpedition Designer",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Xpedition Enterprise",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Xpedition Enterprise XCR",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Xpedition IC Packaging",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Xpedition Layout Browser",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-05T18:17:39.997Z",
"orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
"shortName": "siemens-SADP"
},
"references": [
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-566512.html"
},
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-566435.html"
},
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-166980.html"
}
],
"x_adpType": "supplier"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageName": "php-src",
"product": "PHP",
"vendor": "PHP Group",
"versions": [
{
"lessThan": "8.2.35",
"status": "affected",
"version": "8.2.*",
"versionType": "semver"
},
{
"lessThan": "8.3.36",
"status": "affected",
"version": "8.3.*",
"versionType": "semver"
},
{
"lessThan": "8.4.27",
"status": "affected",
"version": "8.4.*",
"versionType": "semver"
},
{
"lessThan": "8.5.12",
"status": "affected",
"version": "8.5.*",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Wiz"
},
{
"lang": "en",
"type": "reporter",
"value": "Ryan at Calif.io"
},
{
"lang": "en",
"type": "reporter",
"value": "OpenAI"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Arnaud Le Blanc"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Ilija Tovilo"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Jakub Zelenka"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Nora Dossche"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may read or branch on this stale state before it is fully initialized. Multiple strategies can trigger this condition and produce remote code execution (RCE)."
}
],
"value": "PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may read or branch on this stale state before it is fully initialized. Multiple strategies can trigger this condition and produce remote code execution (RCE)."
}
],
"impacts": [
{
"capecId": "CAPEC-234",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-234 Hijacking a privileged process"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 9.2,
"baseSeverity": "CRITICAL",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "CWE-416 Use after free",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-755",
"description": "CWE-755 Improper Handling of Exceptional Conditions",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-824",
"description": "CWE-824 Access of uninitialized pointer",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-1325",
"description": "CWE-1325 Improperly controlled sequential memory allocation",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-1419",
"description": "CWE-1419 Incorrect Initialization of Resource",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T13:54:43.866Z",
"orgId": "dd77f84a-d19a-4638-8c3d-a322d820ed2b",
"shortName": "php"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "RCE via stale global state",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Check the GitHub Security Advisory for mitigation strategies."
}
],
"value": "Check the GitHub Security Advisory for mitigation strategies."
}
],
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "dd77f84a-d19a-4638-8c3d-a322d820ed2b",
"assignerShortName": "php",
"cveId": "CVE-2026-109619",
"datePublished": "2026-10-21T13:54:43.866Z",
"dateReserved": "2026-10-12T21:04:00.504Z",
"dateUpdated": "2026-11-05T18:17:39.997Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-109618 (GCVE-0-2026-109618)
Vulnerability from cvelistv5 – Published: 2026-10-21 13:48 – Updated: 2026-11-05 18:17
VLAI
EPSS
VEX
Title
RCE via OOM corruption
Summary
PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE).
Severity
SSVC
Exploitation: active
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-21 00:00 UTC
CWE
Assigner
php
CNA
References
11 references
Impacted products
107 products
| Vendor | Product | Version | |
|---|---|---|---|
| PHP Group | PHP |
Affected:
8.2.* , < 8.2.35
(semver)
Affected: 8.3.* , < 8.3.36 (semver) Affected: 8.4.* , < 8.4.27 (semver) Affected: 8.5.* , < 8.5.12 (semver) |
|
| Siemens | AMIS TS |
Affected:
0 , < *
(custom)
|
|
| Siemens | AX4 |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | blueplanet 360 NX3 M6 WM OD IISX |
Affected:
0 , < *
(custom)
|
|
| Siemens | blueplanet 360 NX3 M6 WM OD IISX - S |
Affected:
0 , < *
(custom)
|
|
| Siemens | Building X |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | CADRA |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Call stations |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Capital |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Chargesight |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Climatix Cloud IC |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Climatix Devices |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Connect Insights |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Connect X200 |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Connect X300 |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Connect X500 |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | cRSP |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Depotfinity |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Designcenter |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Designcenter X |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Designcenter X Essentials |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Desigo CC |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Desigo DXR2 |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Desigo DXR3 |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Desigo Optic |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Desigo PXC3 |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Desigo PXC4 |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Desigo PXC5 |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Desigo PXC7 |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | DFMExpress |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Energy Engage V2.0SP9 |
Affected:
0 , < *
(custom)
|
|
| Siemens | Energy Engage V3.1SP1 |
Affected:
0 , < *
(custom)
|
|
| Siemens | Energy Management System |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Enlighted RTLS |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Enlighted Space |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Heliox Flex Pro |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Heliox H60 |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Heliox Rapid |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | HyperLynx |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Insights Hub |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Local Monitoring bt-monitoring-vm |
Affected:
0 , < V20261103
(custom)
|
|
| Siemens | Navigator E&S |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Novigo VANSYS |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Novigo VANSYS core |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Opcenter Connect Electronics |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Opcenter Connect MOM |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Opcenter Execution Core |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Opcenter Execution Discrete |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Opcenter Execution Foundation |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Opcenter Execution Pharma |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Opcenter Execution Process |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Opcenter Intelligence |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Opcenter Intra Plant Logistics |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Opcenter Quality |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Opcenter RDnL |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Opcenter X |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | PACE-Design |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | PADS Pro Essentials |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | PADS Pro Student Edition |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | PADS Professional |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | PADS Professional - XCR |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | PADS Standard - XCR |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | PADS Standard & Standard Plus |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Pathway to Learning Engineering |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Polarion |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | QuadView |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | RUGGEDCOM APE1808 |
Affected:
0 , < *
(custom)
|
|
| Siemens | Sicharge D |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Sicharge D Configuration Backend |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | SICHARGE FLEX |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | SICHARGE UC |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Sifinity Control |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Sifinity Go |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Sifinity Setup |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Simcenter Flomaster |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Simcenter Flux |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Simcenter Simlab |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Sinteso FS20 EN |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | SiPass integrated |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | SIPORT |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Siveillance Control |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Siveillance Control Pro |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Siveillance Intrusion |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Siveillance Video |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Solid Edge |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Spectrum Power 4 |
Affected:
0 , < *
(custom)
|
|
| Siemens | Spectrum Power 7 |
Affected:
0 , < *
(custom)
|
|
| Siemens | Spectrum Power TG |
Affected:
0 , < *
(custom)
|
|
| Siemens | Supply Chain Suite |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Teamcenter |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Teamcenter Product Cost Management |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Teamcenter Share |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Teamcenter Visualization |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Tecnomatix Plant Simulation |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | TestWay |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Valor NPI |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Verischarge |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | VersiCloudHeliox Dual Port 60kW |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Voice alarm panels |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Voice alarm systems and audio matrices |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Workplace Experience |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Xcargo |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Xpedition Designer |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Xpedition Enterprise |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Xpedition Enterprise XCR |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Xpedition IC Packaging |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Xpedition Layout Browser |
Unaffected:
0 , < *
(custom)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-109618",
"options": [
{
"Exploitation": "active"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-21T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
},
{
"other": {
"content": {
"dateAdded": "2026-10-26",
"reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-109618"
},
"type": "kev"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-28T03:55:46.712Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://www.wiz.io/blog/php2shell-php-rce"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://arcticwolf.com/resources/blog/php2shell-critical-php-vulnerabilities-enable-unauthenticated-remote-code-execution/"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://php2shell.delftintellab.com"
},
{
"tags": [
"government-resource"
],
"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-109618"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-10-26T00:00:00.000Z",
"value": "CVE-2026-109618 added to CISA KEV"
}
],
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2026-10-29T06:08:47.615Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://www.openwall.com/lists/oss-security/2026/10/21/6"
},
{
"url": "http://www.openwall.com/lists/oss-security/2026/10/23/5"
},
{
"url": "http://seclists.org/fulldisclosure/2026/Oct/51"
}
],
"title": "CVE Program Container"
},
{
"affected": [
{
"defaultStatus": "unknown",
"product": "AMIS TS",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "AX4",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "blueplanet 360 NX3 M6 WM OD IISX",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "blueplanet 360 NX3 M6 WM OD IISX - S",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Building X",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "CADRA",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Call stations",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Capital",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Chargesight",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Climatix Cloud IC",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Climatix Devices",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Connect Insights",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Connect X200",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Connect X300",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Connect X500",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "cRSP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Depotfinity",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Designcenter",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Designcenter X",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Designcenter X Essentials",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Desigo CC",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Desigo DXR2",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Desigo DXR3",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Desigo Optic",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Desigo PXC3",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Desigo PXC4",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Desigo PXC5",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Desigo PXC7",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "DFMExpress",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Energy Engage V2.0SP9",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Energy Engage V3.1SP1",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Energy Management System",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Enlighted RTLS",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Enlighted Space",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Heliox Flex Pro",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Heliox Flex Pro",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Heliox H60",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Heliox Rapid",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "HyperLynx",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Insights Hub",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Local Monitoring bt-monitoring-vm",
"vendor": "Siemens",
"versions": [
{
"lessThan": "V20261103",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Navigator E\u0026S",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Novigo VANSYS",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Novigo VANSYS core",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Opcenter Connect Electronics",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Opcenter Connect MOM",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Opcenter Execution Core",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Opcenter Execution Discrete",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Opcenter Execution Foundation",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Opcenter Execution Pharma",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Opcenter Execution Process",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Opcenter Intelligence",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Opcenter Intra Plant Logistics",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Opcenter Quality",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Opcenter RDnL",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Opcenter X",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "PACE-Design",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "PADS Pro Essentials",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "PADS Pro Student Edition",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "PADS Professional",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "PADS Professional - XCR",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "PADS Standard - XCR",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "PADS Standard \u0026 Standard Plus",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Pathway to Learning Engineering",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Polarion",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "QuadView",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "RUGGEDCOM APE1808",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Sicharge D",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Sicharge D Configuration Backend",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SICHARGE FLEX",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SICHARGE UC",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Sifinity Control",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Sifinity Go",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Sifinity Setup",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Simcenter Flomaster",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Simcenter Flux",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Simcenter Simlab",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Sinteso FS20 EN",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SiPass integrated",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIPORT",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Siveillance Control",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Siveillance Control Pro",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Siveillance Intrusion",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Siveillance Video",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Solid Edge",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Solid Edge",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Spectrum Power 4",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Spectrum Power 4",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Spectrum Power 4",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Spectrum Power 7",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Spectrum Power TG",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Supply Chain Suite",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Teamcenter",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Teamcenter Product Cost Management",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Teamcenter Share",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Teamcenter Visualization",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Tecnomatix Plant Simulation",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "TestWay",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Valor NPI",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Verischarge",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "VersiCloudHeliox Dual Port 60kW",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Voice alarm panels",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Voice alarm systems and audio matrices",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Workplace Experience",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Xcargo",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Xpedition Designer",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Xpedition Enterprise",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Xpedition Enterprise XCR",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Xpedition IC Packaging",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Xpedition Layout Browser",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-05T18:17:38.313Z",
"orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
"shortName": "siemens-SADP"
},
"references": [
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-566512.html"
},
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-566435.html"
},
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-166980.html"
}
],
"x_adpType": "supplier"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageName": "php-src",
"product": "PHP",
"vendor": "PHP Group",
"versions": [
{
"lessThan": "8.2.35",
"status": "affected",
"version": "8.2.*",
"versionType": "semver"
},
{
"lessThan": "8.3.36",
"status": "affected",
"version": "8.3.*",
"versionType": "semver"
},
{
"lessThan": "8.4.27",
"status": "affected",
"version": "8.4.*",
"versionType": "semver"
},
{
"lessThan": "8.5.12",
"status": "affected",
"version": "8.5.*",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Ryan at Calif.io"
},
{
"lang": "en",
"type": "reporter",
"value": "Wiz"
},
{
"lang": "en",
"type": "finder",
"value": "OpenAI"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Arnaud Le Blanc"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Ilija Tovilo"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Jakub Zelenka"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Nora Dossche"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE).\u003cbr\u003e"
}
],
"value": "PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE)."
}
],
"impacts": [
{
"capecId": "CAPEC-234",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-234 Hijacking a privileged process"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 9.2,
"baseSeverity": "CRITICAL",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "CWE-416 Use after free",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-755",
"description": "CWE-755 Improper Handling of Exceptional Conditions",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-824",
"description": "CWE-824 Access of uninitialized pointer",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-1325",
"description": "CWE-1325 Improperly controlled sequential memory allocation",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-1419",
"description": "CWE-1419 Incorrect Initialization of Resource",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T13:48:34.845Z",
"orgId": "dd77f84a-d19a-4638-8c3d-a322d820ed2b",
"shortName": "php"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "RCE via OOM corruption",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Check the GitHub Security Advisory for mitigation strategies."
}
],
"value": "Check the GitHub Security Advisory for mitigation strategies."
}
],
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "dd77f84a-d19a-4638-8c3d-a322d820ed2b",
"assignerShortName": "php",
"cveId": "CVE-2026-109618",
"datePublished": "2026-10-21T13:48:34.845Z",
"dateReserved": "2026-10-12T21:03:58.117Z",
"dateUpdated": "2026-11-05T18:17:38.313Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-109268 (GCVE-0-2026-109268)
Vulnerability from cvelistv5 – Published: 2026-10-12 16:04 – Updated: 2026-10-13 15:33
VLAI
EPSS
VEX
Title
ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Use After Free in PDF Writer via JPEG2000
Summary
ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a use after free vulnerability in the PDF writer when writing CMYK images with JPEG2000 compression. Attackers can supply a crafted CMYK image that, when written to PDF with JPEG2000 compression, causes freed memory to be reused, potentially crashing the process.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-13 15:33 UTC
CWE
- CWE-416 - Use After Free
Assigner
VulnCheck
CNA
References
4 references
| URL | Tags |
|---|---|
| https://github.com/ImageMagick/ImageMagick/securi… | vendor-advisory |
| https://github.com/ImageMagick/ImageMagick/commit… | patch |
| https://github.com/ImageMagick/ImageMagick6/commi… | patch |
| https://www.vulncheck.com/advisories/imagemagick-… | third-party-advisory |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| ImageMagick | ImageMagick |
Affected:
7.0.0-0 , < 7.1.2-32
(custom)
Unaffected: 7.1.2-32 (custom) |
|
| ImageMagick | ImageMagick |
Affected:
0 , < 6.9.13-57
(custom)
Unaffected: 6.9.13-57 (custom) |
Date Public
2026-09-27 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-109268",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-13T15:33:38.579235Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T15:33:55.299Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "ImageMagick",
"vendor": "ImageMagick",
"versions": [
{
"lessThan": "7.1.2-32",
"status": "affected",
"version": "7.0.0-0",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "7.1.2-32",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ImageMagick",
"vendor": "ImageMagick",
"versions": [
{
"lessThan": "6.9.13-57",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "6.9.13-57",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.2-32",
"versionStartIncluding": "7.0.0-0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.9.13-57",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Yanhaoxi"
}
],
"datePublic": "2026-09-27T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a use after free vulnerability in the PDF writer when writing CMYK images with JPEG2000 compression. Attackers can supply a crafted CMYK image that, when written to PDF with JPEG2000 compression, causes freed memory to be reused, potentially crashing the process."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 3.7,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "Use After Free",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-12T16:04:36.039Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-j39j-wmxg-j8mv)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-j39j-wmxg-j8mv"
},
{
"name": "Patch Commit",
"tags": [
"patch"
],
"url": "https://github.com/ImageMagick/ImageMagick/commit/3285d692ebf200e9cbeff59d1ccc00caab99ad54"
},
{
"name": "ImageMagick6 Patch Commit",
"tags": [
"patch"
],
"url": "https://github.com/ImageMagick/ImageMagick6/commit/966e227a1a8b520ea1652e2eb3ca78b08d3206f5"
},
{
"name": "VulnCheck Advisory: ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Use After Free in PDF Writer via JPEG2000",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/imagemagick-before-6.9.13-57-and-7-x-before-7.1.2-32-use-after-free-in-pdf-writer-via-jpeg2000"
}
],
"title": "ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Use After Free in PDF Writer via JPEG2000",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-109268",
"datePublished": "2026-10-12T16:04:36.039Z",
"dateReserved": "2026-10-12T14:11:07.804Z",
"dateUpdated": "2026-10-13T15:33:55.299Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-109254 (GCVE-0-2026-109254)
Vulnerability from cvelistv5 – Published: 2026-10-12 16:04 – Updated: 2026-10-13 16:56
VLAI
EPSS
VEX
Title
FreeRDP 2.1.0 before 3.32.0 Use-After-Free via rdpsnd Disconnect Path
Summary
FreeRDP 2.1.0 before 3.32.0 contains a use-after-free vulnerability in the static rdpsnd channel disconnect path, which frees audio formats and device without joining play_thread. A malicious RDP server can disconnect while asynchronous Wave2 playback processes queued PDUs, causing the client to read freed heap memory and crash.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-13 15:49 UTC
CWE
- CWE-416 - Use After Free
Assigner
VulnCheck
CNA
References
2 references
| URL | Tags |
|---|---|
| https://github.com/FreeRDP/FreeRDP/security/advis… | vendor-advisory |
| https://www.vulncheck.com/advisories/freerdp-2.1.… | third-party-advisory |
Impacted products
Date Public
2026-09-28 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-109254",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-13T15:49:17.767371Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T16:56:42.307Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "FreeRDP",
"vendor": "FreeRDP",
"versions": [
{
"lessThan": "3.32.0",
"status": "affected",
"version": "2.1.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "3.32.0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:freerdp:freerdp:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.32.0",
"versionStartIncluding": "2.1.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "smaeljaish771"
},
{
"lang": "en",
"type": "finder",
"value": "KeenSecurityLab"
}
],
"datePublic": "2026-09-28T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "FreeRDP 2.1.0 before 3.32.0 contains a use-after-free vulnerability in the static rdpsnd channel disconnect path, which frees audio formats and device without joining play_thread. A malicious RDP server can disconnect while asynchronous Wave2 playback processes queued PDUs, causing the client to read freed heap memory and crash."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 6,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "Use After Free",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-12T16:04:26.149Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-vqxm-9w7c-hvvx)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-vqxm-9w7c-hvvx"
},
{
"name": "VulnCheck Advisory: FreeRDP 2.1.0 before 3.32.0 Use-After-Free via rdpsnd Disconnect Path",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/freerdp-2.1.0-before-3.32.0-use-after-free-via-rdpsnd-disconnect-path"
}
],
"title": "FreeRDP 2.1.0 before 3.32.0 Use-After-Free via rdpsnd Disconnect Path",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-109254",
"datePublished": "2026-10-12T16:04:26.149Z",
"dateReserved": "2026-10-12T14:09:00.053Z",
"dateUpdated": "2026-10-13T16:56:42.307Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Mitigation
Architecture and Design
Strategy: Language Selection
Choose a language that provides automatic memory management.
Mitigation
Implementation
Strategy: Attack Surface Reduction
When freeing pointers, be sure to set them to NULL once they are freed. However, the utilization of multiple or complex data structures may lower the usefulness of this strategy.
No CAPEC attack patterns related to this CWE.