PHP internally uses the C library function longjmp to abort script execution when an out‑of‑memory (OOM) error occurs. In certain interpreter contexts the jump happens before request‑related memory is fully cleared, leaving stale data on the stack. The subsequent cleanup routine can then read or branch on this uninitialized memory, enabling an attacker to influence control flow and ultimately execute arbitrary code. The flaw is present in the core PHP interpreter provided by the PHP Group. The CPE listing shows affected host platforms such as Red Hat Enterprise Linux 8, 9 and 10.2, Hummingbird 1, and generic PHP distributions, indicating that any system running a PHP interpreter that relies on longjmp for OOM handling may be impacted.

Affected systems include any installation of the PHP interpreter from the PHP Group. Host platforms that commonly run PHP and are listed in the CVE are Red Hat Enterprise Linux 8, 9 and 10.2, the Hummingbird 1 platform, and systems with generic PHP distributions. No specific PHP version numbers are provided in the CVE data, so any copy of PHP that uses the default longjmp based OOM handling is potentially vulnerable unless otherwise patched.

The high CVSS score of 9.2 indicates a critical impact level for confidentiality, integrity, and availability due to remote code execution. An EPSS score of 100% shows an extremely high likelihood of exploitation in the wild. The vulnerability is listed in the CISA KEV catalog, and the CVE documentation states that attackers can reliably trigger the corruption by sending crafted requests that force an out‑of‑memory situation, enabling remote execution of arbitrary code.