CVE-2026-17544
Out-of-bounds write in bccomp() via crafted operand and scale
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
Attacker-provided inputs to bccomp() could lead to an out-of-bounds write with stack and heap corruption in PHP versions from 8.4.* before 8.4.24 and from 8.5.* before 8.5.9.
| CWE | CWE-787 |
| Vendor | php group |
| Product | php |
| Published | Jul 30, 2026 |
| Last Updated | Jul 30, 2026 |
Stay Ahead of the Next One
Get instant alerts for php group php
Be the first to know when new unknown vulnerabilities affecting php group php are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
PHP Group / PHP
8.4.* < 8.4.24 8.5.* < 8.5.9
References
Credits
Recep Asan Ilija Tovilo - The PHP Foundation Saki Takamachi - The PHP Foundation