Skip to main content

PHP CVE-2026-17544

| EUVDEUVD-2026-51091 HIGH
Out-of-bounds Write (CWE-787)
2026-07-30 php
PHP Buffer Overflow Memory Corruption Red Hat Php Group
8.1
CVSS 4.0 · Vendor: php
Share

Severity by source

Vendor (php) PRIMARY
8.1 HIGH
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:X/V:X/RE:X/U:X
vuln.today AI
8.1 HIGH

AV:N since input can arrive remotely; AC:H because reaching bccomp() with attacker data is application-dependent and converting an OOB write to code execution is nontrivial; PR:N as the function needs no privileges; C/I/A:H for memory corruption in the interpreter.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
9.1 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Red Hat
8.1 HIGH
qualitative

Primary rating from Vendor (php).

CVSS VectorVendor: php

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

3
Patch available
Jul 30, 2026 - 12:03 EUVD
Analysis Generated
Jul 30, 2026 - 11:50 vuln.today
CVE Published
Jul 30, 2026 - 11:22 cve.org
HIGH 8.1

DescriptionCVE.org

Attacker-provided inputs to bccomp() could lead to an out-of-bounds write with stack and heap corruption in PHP versions from 8.4.* before 8.4.24 and from 8.5.* before 8.5.9.

AnalysisAI

Out-of-bounds write in PHP's BCMath bccomp() function allows attacker-controlled inputs to corrupt stack and heap memory in PHP 8.4.x before 8.4.24 and 8.5.x before 8.5.9, with high confidentiality, integrity, and availability impact per the vendor CVSS 4.0 score of 8.1. Exploitation requires an application to pass attacker-influenced values into bccomp() with the BCMath extension enabled; there is no public exploit identified at time of analysis (CVSS E:U, no KEV listing). Memory corruption of this class can lead to crashes and, potentially, arbitrary code execution within the PHP process.

Technical ContextAI

The flaw resides in PHP's BCMath extension, specifically the bccomp() function used for arbitrary-precision decimal comparison. Per CWE-787 (Out-of-bounds Write), the root cause is a memory-safety defect in which improperly validated numeric string inputs cause writes past allocated buffer boundaries, corrupting both stack and heap regions of the PHP interpreter's memory. The affected CPE cpe:2.3:a:php_group:php identifies the PHP interpreter itself; because BCMath processes user-supplied numeric strings, any code path where external data reaches bccomp() (directly or via a wrapper) exposes the interpreter to memory corruption. The tags PHP, Buffer Overflow, and Memory Corruption corroborate this as a classic buffer-boundary write in the interpreter's C code.

RemediationAI

Vendor-released patch: upgrade to PHP 8.4.24 or later on the 8.4 branch, or PHP 8.5.9 or later on the 8.5 branch, per the PHP security advisory GHSA-x692-q9x7-8c3f (https://github.com/php/php-src/security/advisories/GHSA-x692-q9x7-8c3f). If immediate patching is not possible, compensating controls include disabling the BCMath extension where it is not required (trade-off: any application relying on bccomp/bcadd/etc. will break), and adding strict server-side validation/normalization of numeric string inputs before they reach bccomp() to reject malformed or oversized values (trade-off: requires code review of all call sites and may reject legitimate edge-case inputs). Where BCMath is needed, restrict which endpoints accept user-supplied numeric arguments and enforce length/format limits at the application boundary.

More in PHP

View all
CVE-2019-11043 CRITICAL POC
9.8 Oct 28

In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it

CVE-2012-1823 CRITICAL POC
9.8 May 11

sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
CVE-2016-1555 CRITICAL POC
9.8 Apr 21

(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
CVE-2018-11138 CRITICAL POC
9.8 May 31

The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
CVE-2024-11680 CRITICAL POC
9.8 Nov 26

ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
CVE-2025-49113 CRITICAL POC
9.9 Jun 02

Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
CVE-2017-9841 CRITICAL POC
9.8 Jun 27

Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
CVE-2025-0108 HIGH POC
8.8 Feb 12

Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers

CVE-2021-25298 HIGH POC
8.8 Feb 15

Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
CVE-2021-25296 HIGH POC
8.8 Feb 15

Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
CVE-2013-4983 CRITICAL POC
10.0 Sep 10

The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
CVE-2023-6553 CRITICAL POC
9.8 Dec 15

The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1

Same weakness CWE-787 – Out-of-bounds Write

View all
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2012-1889 HIGH POC
8.8
CVE-2010-3333 HIGH POC
7.8
CVE-2014-1761 HIGH POC
7.8
CVE-2009-3129 HIGH POC
7.8
CVE-2021-1732 HIGH POC
7.8
CVE-2013-3346 CRITICAL POC
9.8

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Critical
Product Status
openSUSE Tumbleweed Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected
SUSE Linux Enterprise Module for Legacy 15 SP7 Affected
SUSE Linux Enterprise Module for Package Hub 15 SP7 Affected

Share

CVE-2026-17544 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy