CVE-2026-17544

CriticalCVSS 9.8

Published: 30/07/2026(UTC)Updated: 05/08/2026(UTC)Translated: 30/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.43%

35th percentile - higher than 35% of all known CVEs

Summary

The bccomp() function in PHP (versions 8.4.x before 8.4.24 and 8.5.x before 8.5.9) improperly handles attacker-supplied input, which can lead to an out-of-bounds write and stack/heap corruption.

Risk Assessment

An attacker could remotely crash the application or potentially execute arbitrary code, compromising system integrity and availability.

Recommendation

Immediately upgrade PHP to version 8.4.24, 8.5.9, or later.

Original NVD description (English source)

Attacker-provided inputs to bccomp() could lead to an out-of-bounds write with stack and heap corruption in PHP versions from 8.4.* before 8.4.24 and from 8.5.* before 8.5.9.