PHP aborts a request on an out-of-memory (OOM) error with longjmp(). If an allocation fails while request memory is reachable but not yet fully initialized, the request is left in an invalid state that request shutdown later reads, leading to heap use-after-free and remote code execution. An unauthenticated attacker can force OOM through multipart request parsing. Apache mod_php is exploitable before any application code runs, and FPM is also susceptible. Fixed in PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12. End-of-life branches receive no fix.