CVE-2026-17544
published 2026-07-30CVE-2026-17544: Attacker-provided inputs to bccomp() could lead to an out-of-bounds write with stack and heap corruption in PHP versions from 8.4.* before 8.4.24 and from…
PriorityP356critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
0.43%
35.8th percentile
Attacker-provided inputs to bccomp() could lead to an out-of-bounds write with stack and heap corruption in PHP versions from 8.4.* before 8.4.24 and from 8.5.* before 8.5.9.
Affected
9 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | php8.4 | — | — |
| php | php | — | — |
| php | php | >= 8.4.0 < 8.4.24 | 8.4.24 |
| php | php | >= 8.5.0 < 8.5.9 | 8.5.9 |
| php_group | php | >= 8.4.* < 8.4.24 | 8.4.24 |
| php_group | php | >= 8.5.* < 8.5.9 | 8.5.9 |
| ubuntu | php8.1 | — | — |
| ubuntu | php8.3 | — | — |
| ubuntu | php8.5 | — | — |
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv4.08.1HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:X/V:X/RE:X/U:X
vendor_redhat9.8CRITICAL
vendor_ubuntu9.8CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
PHP vulnerabilities
vendor_ubuntu·2026-09-10·CVSS 9.8
CVE-2026-17544 [CRITICAL] PHP vulnerabilities
Title: PHP vulnerabilities
Summary: Several security issues were fixed in PHP.
It was discovered that PHP incorrectly handled backslash escaping in the
PostgreSQL extension. An attacker could use this issue to perform SQL
injection attacks. (CVE-2026-17543)
It was discovered that PHP incorrectly handled certain inputs to the
bccomp() function. An attacker could use this issue to cause an out-of-
bounds write, resulting in a denial of service or possibly execute
arbitrary code. This issue only affected Ubuntu 26.04 LTS. (CVE-2026-17544)
It was discovered that PHP incorrectly handled circular symbolic links in
phar archives. An attacker could use this issue to cause unbounded
recursion, resulting in a denial of service. (CVE-2026-7260)
Instructions: In general, a standard system update
Red Hat
php: PHP: Arbitrary code execution via out-of-bounds write in bccomp()
vendor_redhat·2026-07-30·CVSS 9.8
CVE-2026-17544 [CRITICAL] CWE-787 php: PHP: Arbitrary code execution via out-of-bounds write in bccomp()
php: PHP: Arbitrary code execution via out-of-bounds write in bccomp()
Attacker-provided inputs to bccomp() could lead to an out-of-bounds write with stack and heap corruption in PHP versions from 8.4.* before 8.4.24 and from 8.5.* before 8.5.9.
A flaw was found in PHP. A remote attacker could exploit this vulnerability by providing specially crafted inputs to the `bccomp()` function. This could lead to an out-of-bounds write, resulting in stack and heap corruption. Such memory corruption can enable arbitrary code execution, allowing the attacker to take control of the affected system.
Statement: This is an Important flaw in PHP that could lead to arbitrary code execution due to an out-of-bounds write in the `bccomp()` function. While exploitation requires high attack complexity, a succ
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-17544 php: PHP: Arbitrary code execution via out-of-bounds write in bccomp() [fedora-all]
bugzilla·2026-08-05·CVSS 9.8
CVE-2026-17544 [CRITICAL] CVE-2026-17544 php: PHP: Arbitrary code execution via out-of-bounds write in bccomp() [fedora-all]
CVE-2026-17544 php: PHP: Arbitrary code execution via out-of-bounds write in bccomp() [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Attacker-provided inputs to bccomp() could lead to an out-of-bounds write with stack and heap corruption in PHP versions from 8.4.* before 8.4.24 and from 8.5.* before 8.5.9.
Discussion:
PHP 8.5.9 already in F44 stable
---
FEDORA-2026-d755ca77c4 (php-8.4.24-1.fc43) has been submitted as an update to Fedora 43.
https://bodhi.fedoraproject.org/updates/FEDORA-2026-d755ca77c4
Bugzilla
CVE-2026-17544 php: PHP: Arbitrary code execution via out-of-bounds write in bccomp()
bugzilla·2026-07-30·CVSS 9.8
CVE-2026-17544 [CRITICAL] CVE-2026-17544 php: PHP: Arbitrary code execution via out-of-bounds write in bccomp()
CVE-2026-17544 php: PHP: Arbitrary code execution via out-of-bounds write in bccomp()
Attacker-provided inputs to bccomp() could lead to an out-of-bounds write with stack and heap corruption in PHP versions from 8.4.* before 8.4.24 and from 8.5.* before 8.5.9.
Discussion:
Notice: Versions < 8.4 are not affected
2026-07-30
Published