php: PHP: Arbitrary code execution via out-of-bounds write in bccomp()

A flaw was found in PHP. A remote attacker could exploit this vulnerability by providing specially crafted inputs to the bccomp function. This could lead to an out-of-bounds write, resulting in stack and heap corruption. Such memory corruption can enable arbitrary code execution, allowing the...

Important: Red Hat Security Advisory: php8.4 security, bug fix, and enhancement update

An update for php8.4 is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from t...

ALSA-2026:56969 Important: php8.4 security, bug fix, and enhancement update

PHP is an HTML-embedded scripting language. PHP attempts to make it easy for developers to write dynamically generated web pages. PHP also offers built-in database integration for several commercial and non-commercial database management systems, so writing a database-enabled webpage with PHP is...

K000162967: PHP vulnerability CVE-2026-17544

Security Advisory Description Attacker-provided inputs to bccomp could lead to an out-of-bounds write with stack and heap corruption in PHP versions from 8.4. before 8.4.24 and from 8.5. before 8.5.9. CVE-2026-17544 Impact There is no impact; F5 products are not affected by this vulnerability...

BIT-PHP-MIN-2026-17544 Out-of-bounds write in bccomp() via crafted operand and scale

Attacker-provided inputs to bccomp could lead to an out-of-bounds write with stack and heap corruption in PHP versions from 8.4. before 8.4.24 and from 8.5. before 8.5.9...

BIT-PHP-2026-17544 Out-of-bounds write in bccomp() via crafted operand and scale

Attacker-provided inputs to bccomp could lead to an out-of-bounds write with stack and heap corruption in PHP versions from 8.4. before 8.4.24 and from 8.5. before 8.5.9...

BIT-LIBPHP-2026-17544 Out-of-bounds write in bccomp() via crafted operand and scale

Attacker-provided inputs to bccomp could lead to an out-of-bounds write with stack and heap corruption in PHP versions from 8.4. before 8.4.24 and from 8.5. before 8.5.9...

PT-2026-73367

Attacker-provided inputs to bccomp could lead to an out-of-bounds write with stack and heap corruption in PHP versions from 8.4. before 8.4.24 and from 8.5. before 8.5.9...

PT-2026-73421

Attacker-provided inputs to bccomp could lead to an out-of-bounds write with stack and heap corruption in PHP versions from 8.4. before 8.4.24 and from 8.5. before 8.5.9...

PT-2026-73418

Attacker-provided inputs to bccomp could lead to an out-of-bounds write with stack and heap corruption in PHP versions from 8.4. before 8.4.24 and from 8.5. before 8.5.9...

Exploit for Out-of-bounds Write in Php

CVE-2026-17544 — PHP bcmath bccomp Out-of-Bounds Write St...

openSUSE 16: apache2-mod_php8 / php8 / php8-bcmath / php8-bz2 / php8-calendar / etc (openSUSE-SU-2026:21532-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21532-1 advisory. This update for php8 fixes the following issues - Update to version 8.4.24 - CVE-2026-7260: Stack overflow in phar with circular symlinks...

OPENSUSE-SU-2026:21532-1 Security update for php8

This update for php8 fixes the following issues - Update to version 8.4.24 - CVE-2026-7260: Stack overflow in phar with circular symlinks bsc1273077. - CVE-2026-9672: Upgrade libgd bsc1273078. - CVE-2026-17543: SQL injection in ext-pgsql via E'...' backslash breakout bsc1273075. - CVE-2026-17544:...

CVE-2026-17544

A flaw was found in PHP. A remote attacker could exploit this vulnerability by providing specially crafted inputs to the bccomp function. This could lead to an out-of-bounds write, resulting in stack and heap corruption. Such memory corruption can enable arbitrary code execution, allowing the...

SUSE CVE-2026-17544

Attacker-provided inputs to bccomp could lead to an out-of-bounds write with stack and heap corruption in PHP versions from 8.4. before 8.4.24 and from 8.5. before 8.5.9...

CVE-2026-17544

Attacker-provided inputs to bccomp could lead to an out-of-bounds write with stack and heap corruption in PHP versions from 8.4. before 8.4.24 and from 8.5. before 8.5.9...

UBUNTU-CVE-2026-17544

Attacker-provided inputs to bccomp could lead to an out-of-bounds write with stack and heap corruption in PHP versions from 8.4. before 8.4.24 and from 8.5. before 8.5.9...

CVE-2026-17544 Out-of-bounds write in bccomp() via crafted operand and scale

Attacker-provided inputs to bccomp could lead to an out-of-bounds write with stack and heap corruption in PHP versions from 8.4. before 8.4.24 and from 8.5. before 8.5.9...

CVE-2026-17544

PHP core: vulnerability CVE-2026-17544 involves bccomp() receiving attacker-provided inputs that can trigger an out-of-bounds write, causing stack and heap corruption. Affected versions are PHP 8.4.* before 8.4.24 and 8.5.* before 8.5.9. The CVSS score is 9.3 (CRITICAL) with network attack vector...

CVE-2026-17544

Attacker-provided inputs to bccomp could lead to an out-of-bounds write with stack and heap corruption in PHP versions from 8.4. before 8.4.24 and from 8.5. before 8.5.9...