Full Disclosure mailing list archives

CVE-2026-109618: Pointer underflow in PHP's CGI SAPI enables
unauthenticated remote code execution.

Affected: ALL PHP versions 5.x through 8.4.26 with cgi.fix_pathinfo=1
(default configuration). Same vulnerability class as CVE-2019-11043
(PHP-FPM, CVSS 9.8, patched 2019) — the CGI SAPI never received the
equivalent fix.

Fix: PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35 (scheduled Oct 21, 2026 14:00 UTC)
PHP 8.1 and earlier (EOL) receive NO fix.

Root cause: sapi/cgi/cgi_main.c — missing bounds check in path_info
pointer arithmetic. Fix: php-src PR #23411 adds the guard.

Exploitation chain (independently confirmed, 9/9 automated tests):
1. OOB Read — leak heap data via corrupted PATH_INFO
2. Info Leak — extract fcgi_data_seg pointers (ASLR bypass)
3. Write Primitive — ASAN SCARINESS 30 (wild-addr-write)
4. Code Execution — .user.ini auto_prepend_file injection

Mitigation: set cgi.fix_pathinfo=0 in php.ini

Exposure: ~884,000 internet-facing hosts on EOL PHP versions.
Default PHP configuration is vulnerable.

IMPORTANT: Several "PoC" repositories on exploit aggregators claim to
target CVE-2026-109618 but actually exploit session.upload_progress UAF —
a completely different vulnerability. Disabling session.upload_progress
does NOT mitigate this vulnerability. The correct mitigation is
cgi.fix_pathinfo=0.

Detection: %0a/%0d in URI path targeting .php endpoints (very low false
positive rate).

References:
php-src PR #23411:
https://www.google.com/url?q=https://github.com/php/php-src/pull/23411&source=gmail&ust=1792646638609000&sa=E
CVE-2019-11043 (FPM equivalent):
https://www.google.com/url?q=https://nvd.nist.gov/vuln/detail/CVE-2019-11043&source=gmail&ust=1792646638609000&sa=E

Full PoC will be published after patches are available.

Independent discovery via source code audit.
Jose
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/

Current thread:

• CVE-2026-109618: PHP-CGI Pointer Underflow → Remote Code Execution (CVSS 9.2) jose (Oct 27)