CVE-2026-17544

CVE-2026-17544 — PHP bcmath OOB write → universal memory-only RCE A weaponized proof-of-concept for CVE-2026-17544 , an out-of-bounds write in PHP's rewritten bcmath extension bcstr2num. This turns the publicly known DoS-only crash into a full, universal, memory-only remote code execution primiti...

Rocky Linux 9.2 [CIQ] Security Update: php / php-bcmath / php-cli / php-common / php-dba / php-dbg / etc Multiple Vulnerabilities (ciqsa-2026_1719)

The Rocky Linux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-20261719 advisory. This advisory aggregates security fixes for the php SRPM in CIQ LTS 9.2. It addresses 2 CVEs: CVE-2026-109619, CVE-2026-109618. Tenable has extracted the...

Rocky Linux 9.2 [CIQ] Security Update: php / php-bcmath / php-cli / php-common / php-dba / php-dbg / etc Multiple Vulnerabilities (ciqsa-2026_1718)

The Rocky Linux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-20261718 advisory. This advisory aggregates security fixes for the php SRPM in CIQ LTS 9.2. It addresses 2 CVEs: CVE-2026-109619, CVE-2026-109618. Tenable has extracted the...

CentOS Linux 7.9 [CIQ] Security Update: php / php-bcmath / php-cli / php-common / php-dba / php-devel / etc Multiple Vulnerabilities (ciqsa-2026_1717)

The CentOS Linux 7.9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-20261717 advisory. This advisory aggregates security fixes for the php SRPM in CIQ CentOS Bridge 7.9. It addresses 2 CVEs: CVE-2026-109619, CVE-2026-109618. Tenable has...

Rocky Linux 8.6 [CIQ] Security Update: php / php-bcmath / php-cli / php-common / php-dba / php-dbg / etc Multiple Vulnerabilities (ciqsa-2026_1667)

The Rocky Linux 8.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-20261667 advisory. This advisory aggregates security fixes for the php SRPM in CIQ LTS 8.6. It addresses 2 CVEs: CVE-2026-109619, CVE-2026-109618. Tenable has extracted the...

Rocky Linux 9.6 [CIQ] Security Update: php / php-bcmath / php-cli / php-common / php-dba / php-dbg / etc Multiple Vulnerabilities (ciqsa-2026_1716)

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-20261716 advisory. This advisory aggregates security fixes for the php SRPM in CIQ LTS 9.6. It addresses 2 CVEs: CVE-2026-109619, CVE-2026-109618. Tenable has extracted the...

Rocky Linux 9.6 [CIQ] Security Update: php / php-bcmath / php-cli / php-common / php-dba / php-dbg / etc Multiple Vulnerabilities (ciqsa-2026_1715)

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-20261715 advisory. This advisory aggregates security fixes for the php SRPM in CIQ LTS 9.6. It addresses 2 CVEs: CVE-2026-109619, CVE-2026-109618. Tenable has extracted the...

Rocky Linux 8.6 [CIQ] Security Update: php / php-bcmath / php-cli / php-common / php-dba / php-dbg / etc Multiple Vulnerabilities (ciqsa-2026_1668)

The Rocky Linux 8.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-20261668 advisory. This advisory aggregates security fixes for the php SRPM in CIQ LTS 8.6. It addresses 2 CVEs: CVE-2026-109619, CVE-2026-109618. Tenable has extracted the...

Rocky Linux 9.2 [CIQ] Security Update: php / php-bcmath / php-cli / php-common / php-dba / php-dbg / etc Multiple Vulnerabilities (ciqsa-2026_1659)

The Rocky Linux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-20261659 advisory. This advisory aggregates security fixes for the php SRPM in CIQ LTS 9.2. It addresses 2 CVEs: CVE-2026-109619, CVE-2026-109618. Tenable has extracted the...

Rocky Linux 9.6 [CIQ] Security Update: php / php-bcmath / php-cli / php-common / php-dba / php-dbg / etc Multiple Vulnerabilities (ciqsa-2026_1658)

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-20261658 advisory. This advisory aggregates security fixes for the php SRPM in CIQ LTS 9.6. It addresses 4 CVEs: CVE-2026-109619, CVE-2026-7568, CVE-2026-109618,...

Amazon Linux 2023 : php8.3, php8.3-bcmath, php8.3-cli (ALAS2023-2026-3302)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3302 advisory. PHP uses longjmp for out-of-memory OOM errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory i...

Rocky Linux 9.2 [CIQ] Security Update: php / php-bcmath / php-cli / php-common / php-dba / php-dbg / etc Multiple Vulnerabilities (ciqsa-2026_1654)

The Rocky Linux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-20261654 advisory. This advisory aggregates security fixes for the php SRPM in CIQ LTS 9.2. It addresses 27 CVEs: CVE-2024-8925, CVE-2025-1217, CVE-2025-14177, CVE-2012-238...

Amazon Linux 2023 : php8.3, php8.3-bcmath, php8.3-cli (ALAS2023-2026-3162)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3162 advisory. The mysqlnd wire protocol parser reads fields out of server packets before checking that the packet still holds enough bytes for them. A malicious or compromised MySQL server can send a...

Rocky Linux 8.6 [CIQ] Security Update: php / php-bcmath / php-cli / php-common / php-dba / php-dbg / etc Multiple Vulnerabilities (ciqsa-2026_1608)

The Rocky Linux 8.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-20261608 advisory. This advisory aggregates security fixes for the php SRPM in CIQ LTS 8.6. It addresses 13 CVEs: CVE-2012-2386, CVE-2013-4248, CVE-2013-4113, CVE-2012-2329...

CVE-2026-17544-PoC

CVE-2026-17544 — PHP bcmath bccomp Out-of-Bounds-Write Stack-Smashing CVSS 9.8 Kritisch · CWE-787 · GHSA-x692-q9x7-8c3f Zusammenfassung bcstr2num in ext/bcmath/libbcmath/src/str2num.c mitgeliefertes libbcmath, PHP 8.4+ enthält einen Off-by-N-Out-of-Bounds-Write. Wenn die vom Benutzer angegebene...

CentOS Linux 7.9 [CIQ] Security Update: php / php-bcmath / php-cli / php-common / php-dba / php-devel / etc (ciqsa-2026_1592)

The CentOS Linux 7.9 host has packages installed that are affected by a vulnerability as referenced in the CIQ ciqsa-20261592 advisory. This advisory aggregates security fixes for the php SRPM in CIQ CentOS Bridge 7.9. It addresses 1 CVE: CVE-2024-8927. Tenable has extracted the preceding...

CentOS Linux 8 [TuxCare] Security Update: php / php-bcmath / php-cli / php-common / php-dba / php-dbg / etc Multiple Vulnerabilities (CENTOS-STREAM8:CLSA-2026:1791395301)

The CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS-STREAM8:CLSA-2026:1791395301 advisory. - The mysqlnd wire protocol parser reads fields out of server packets before checking that the packet still holds enough bytes fo...

Rocky Linux 9.6 [CIQ] Security Update: php / php-bcmath / php-cli / php-common / php-dba / php-dbg / etc Multiple Vulnerabilities (ciqsa-2026_1587)

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-20261587 advisory. This advisory aggregates security fixes for the php SRPM in CIQ LTS 9.6. It addresses 28 CVEs: CVE-2024-8925, CVE-2025-1217, CVE-2012-2386, CVE-2024-1123...

Fedora 43 : php (2026-d5e4829deb)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-d5e4829deb advisory. PHP version 8.4.26 24 Sep 2026 BCMath: Fixed out-of-bounds read in bciszeroforscale when scale exceeds nscale. Ilia Alshanetsky Core: Fixed...

AlmaLinux 9.2 [TuxCare] Security Update: php / php-bcmath / php-cli / php-common / php-dba / php-dbg / etc (ALMALINUX9.2:CLSA-2026:1778240943)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1778240943 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number. %NASLMINLEVEL...