[ASA-202610-2] php-legacy: arbitrary code execution

Arch Linux Security Advisory ASA-202610-2 ========================================= Severity: Critical Date : 2026-10-21 CVE-ID : CVE-2026-109618 CVE-2026-109619 Package : php-legacy Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-2910 Summary ======= The...

security flaw

scanf.c in PHP 5.1.4 and earlier, and 4.4.3 and earlier, allows context-dependent attackers to execute arbitrary code via a sscanf PHP function call that performs argument swapping, which increments an index past the end of an array and triggers a buffer over-read...