Out-of-bounds write in PHP - CVE-2026-17544
Published: August 3, 2026
Vulnerability identifier: #VU140834
CSH Severity: Medium
CVSS v4: 9.2 [CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-17544
CWE-ID: CWE-787
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to compromise vulnerable system.
The vulnerability exists due to a boundary error when processing untrusted input within the bc_str2num() function. A remote attacker can pass specially crafted input to the application that is using the affected function, trigger an out-of-bounds write and crash the application or potentially execute arbitrary code.
Affected software
PHP
Debian Linux
Fedora
php
php8.4 (Debian package)
Debian Linux
Fedora
php
php8.4 (Debian package)
How to mitigate CVE-2026-17544
Install updates from vendor's website.
PHP - addressed in versions 8.4.24, 8.5.9
php - addressed in versions 8.4.24-1.fc43, 8.5.9-1.fc44
php8.4 (Debian package) - update to 8.4.24-1~deb13u1
php - addressed in versions 8.4.24-1.fc43, 8.5.9-1.fc44
php8.4 (Debian package) - update to 8.4.24-1~deb13u1