XenForo EUVD-2026-72758

The attacker must possess a registered XenForo forum account with standard post-creation privileges (PR:L); no moderator or administrator rights are required. The vulnerable BBCode parser is always active for forum posts - no non-default configuration or feature flag enables the attack surface. The persistent DoS condition affects all visitors to the thread running any XenForo version prior to 2.3.13 with PHP-FPM as the process manager (the dominant PHP deployment model). The key limiting factor is the authentication requirement: anonymous internet users cannot trigger the vulnerability, which reduces exposure for invite-only or closed-registration forums while leaving open-registration communities broadly exposed.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VA:H) accurately captures the threat profile: network-accessible, no special configuration needed, only a standard registered account required, and high availability impact. The persistence mechanism is the key real-world risk amplifier - unlike a transient crash, a single malicious post keeps killing PHP-FPM workers until administratively remediated, making the effective blast radius proportional to thread traffic. No EPSS data was provided and the vulnerability is not in CISA KEV, but the exploit primitive (nested BBCode tags) is trivially constructible without tooling, putting it within reach of any forum member with minimal technical skill. Forums with open or low-barrier registration face the greatest exposure. The purely availability-focused impact (C:N/I:N) and the PR:L authentication requirement bound the risk - this is not remotely unauthenticated and has no confidentiality or integrity consequence - but the persistent DoS mechanism elevates operational urgency above a typical single-request crash vulnerability.

An attacker with a standard registered XenForo account crafts a post containing thousands of nested BBCode tags - for example, hundreds of stacked [quote] or [b] elements - and submits it to a high-traffic thread. When any visitor's request causes PHP to render the thread, the BBCode parser recurses through the nesting until it exceeds PHP's call-stack limit, crashes the PHP-FPM worker with a fatal error, and terminates the response. Because the post persists, every subsequent worker assigned to the thread suffers the same fate; the forum effectively goes offline for all users accessing that thread until an administrator removes the post. No public exploit code has been identified, but the technique requires no special tooling.