Abstract
CVE-2026-109618 and CVE-2026-109619 affect the PHP interpreter included in QSAN QSM 3 and XEVO 2 firmware. Both vulnerabilities have been fixed in the releases listed below.
Both vulnerabilities reside in the request memory handling of the PHP interpreter, where uninitialized or stale request memory may be read during request cleanup or on subsequent requests, potentially leading to remote code execution. QSM 4 and XEVO 3 firmware do not include PHP and are not affected.
Applied to
| Product | Severity | Fixed Release Availability |
|---|---|---|
| QSM 3 | Important | 3.5.6 |
| XEVO 2 | Important | 2.3.13 (XCubeFAS XF3126D: 2.3.8) |
| QSM 4 | Not Affected | N/A |
| XEVO 3 | Not Affected | N/A |
Mitigation
Upgrade to the latest firmware. See QSAN Technical Support.
Detail
CVE-2026-109618
Severity: Critical
CVSS3 Base Score: 9.8
CVSS3 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE).
CVE-2026-109619
Severity: High
CVSS3 Base Score: 8.1
CVSS3 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may read or branch on this stale state before it is fully initialized. Multiple strategies can trigger this condition and produce remote code execution (RCE).