| Advisory ID | Severity | Release Date | Reported By | CVE ID |
| HSVD-2026-0113 | Critical | November 2, 2026 | CVE | CVE-2026-109618 CVE-2026-109619 |
Overview
Multiple Hillstone products are affected by vulnerabilities in a third-party PHP component, as follows.
CVE-2026-109618: When PHP handles an out-of-memory (OOM) error, it uses longjmp() to exit the current context prematurely; request memory becomes accessible before it is fully initialized, and the shutdown process treats memory in an invalid state as if it were in a valid state. An attacker can exhaust memory_limit without exceeding post_max_size by crafting a malicious multipart request, triggering memory corruption and achieving remote code execution.
CVE-2026-109619: A PHP worker process retains global state pointing to the previous request’s memory without fully resetting it before release, resulting in a cross-request use-after-free. An attacker can act as producer and consumer across two requests handled by the same worker process, achieving unauthenticated heap use-after-free, memory disclosure, or remote code execution; this is more easily exploitable when the device’s web management interface is exposed. Exploitation requires that the attacker can reach the device’s web management page over the network. Successful exploitation could allow an attacker to execute remote code, potentially resulting in device compromise or crash, and impacting the confidentiality, integrity, and availability of the system.
Vulnerability Risk
An attacker could exploit this vulnerability to execute remote code, which may result in device compromise or device crash, affecting the confidentiality, integrity, and availability of the system.
Exploitation Conditions
The attacker must be able to reach the device’s web management interface over the network.
Affected Products & Fix Versions
| Product | Affected Version | Fixed Version | Expected Fix Release Date |
|---|---|---|---|
| WAF | All versions | W-5.5R12-4.1.3 | Released |
| IPS | All versions | 6.4.1 | Released |
| IFW | All versions | 4.4.2 | Released |
| IDA | All versions | 4.4.2 | Released |
| IIDS | All versions | 4.4.2 | Released |
| ADC | All versions | — | November 15, 2026 |
| NGFW | All versions | 5.5R4P28.5, 5.5R6P33.3, 5.5R8P34, 5.5R10P19.1, 5.5R11P11.1, 5.5R12P4.5 | Released |
| BDS | All versions | 6.4.1 | Released |
| CloudHive | All versions | — | November 9, 2026 |
| LMS | All versions | — | November 9, 2026 |
Remediation & Mitigation
- For specific mitigation measures and handling instructions, please refer to https://kb.hillstonenet.com/cn/php-vuln-fix-for-stoneos/. If you have any questions, please contact Hillstone technical support at https://support.hillstonenet.com.
Contact & Reporting
For technical support and detailed remediation guidance, contact Hillstone Networks support at https://support.hillstonenet.com.
To report security issues in Hillstone products, email PSIRT@hillstonenet.com. Hillstone follows responsible disclosure principles and applicable regulations when handling product security incidents.
Legal notice — Without written authorization from Hillstone Networks, no organization or individual may modify, excerpt, or disseminate the content of this advisory for commercial purposes.
Recent Comments