CVE-2026-17544

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-17544
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-17544.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-17544
Aliases
Downstream
ALPINE (1)
ALSA (1)
BELL (1)
DEBIAN (1)
MGASA (2)
MINI (2)
openSUSE (2)
RHSA (2)
RLSA (1)
SUSE (3)
UBUNTU (1)
Related
ALSA (1)
openSUSE (2)
SUSE (3)
Published
2026-07-30T11:22:24Z
Modified
2026-11-11T02:55:54Z
Severity
  • 8.1 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/AU:N CVSS Calculator
Summary
Out-of-bounds write in bccomp() via crafted operand and scale
Details

Attacker-provided inputs to bccomp() could lead to an out-of-bounds write with stack and heap corruption in PHP versions from 8.4.* before 8.4.24 and from 8.5.* before 8.5.9.

Database specific 
{
    "cna_assigner": "php",
    "cwe_ids": [
        "CWE-787"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/17xxx/CVE-2026-17544.json"
}
References

Affected packages

Git / github.com/php/php-src

Affected ranges

Type
GIT
Repo
https://github.com/php/php-src
Events
Introduced
b437f2b32eb364c9496d24abcc734272e5c9c980
Fixed
fb193d3df72d1ca3b5ef58ec9e9b6ef5bdf18bef
Introduced
685e99655ae97c667950f7f7d176985958718f56
Fixed
dd6e76cce27aaa0ed9f7520648ed1081dfb6af36
Database specific
Show details 
{
    "extracted_events": [
        {
            "cpe": "cpe:2.3:a:php:php:*:*:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "8.4.0"
                },
                {
                    "fixed": "8.4.24"
                }
            ],
            "source": "CPE_RANGE"
        },
        {
            "cpe": "cpe:2.3:a:php:php:*:*:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "8.5.0"
                },
                {
                    "fixed": "8.5.9"
                }
            ],
            "source": "CPE_RANGE"
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-17544.json"