Statement on CVE 2026-109618 PHP - RCE via OOM Corruption Vulnerability

October 21, 2026

Information

A vulnerability in PHP’s out-of-memory (OOM) error handling may leave request memory improperly initialized, potentially allowing an attacker to exploit subsequent memory cleanup operations and achieve remote code execution (RCE).

For additional information, please refer to NIST. CVE-2026-109618.

Risk

Medium

Response

Melissa Data Corporation (“Melissa”) was not impacted by the PHP - RCE via OOM corruption vulnerability. Melissa has performed a thorough investigation of both in-house built APIs, web interfaces, and vendor supplied solutions. Melissa has taken the necessary steps to update any affected versions to fixed versions and confirm no impact because there are no indicators of compromise. Melissa will continue to follow all guidance provided for this vulnerability as necessary to prevent any future risks.