p PatchFirst

CVE-2026-17544

CVE-2026-17544 · Out-of-bounds write in bccomp() via crafted operand and scale

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Attacker-provided inputs to bccomp() could lead to an out-of-bounds write with stack and heap corruption in PHP versions from 8.4.* before 8.4.24 and from 8.5.* before 8.5.9.

CVSS 8.1 · High · EPSS 0.4% · Fix available

Published
Updated

Stack: system · php

Affected products and versions

  • php

    Versions
    • ≥ 8.4.*, < 8.4.24: Affected (semver)
    • ≥ 8.5.*, < 8.5.9: Affected (semver)

    Update to 8.4.24; Update to 8.5.9

  • php8.4 Debian:13

    Versions
    • 8.4.11-1
    • 8.4.16-1
    • 8.4.16-1~deb13u1
    • 8.4.20-1
    • 8.4.21-1
    • 8.4.21-1~deb13u1
    • 8.4.22-1
    • 8.4.23-1
    • 8.4.23-1~deb13u1
    Affected ranges
    • ECOSYSTEM: < 8.4.24-1~deb13u1

    Update to 8.4.24-1~deb13u1

  • php8.4 Debian:14

    Versions
    • 8.4.11-1
    • 8.4.16-1
    • 8.4.16-1~deb13u1
    • 8.4.20-1
    • 8.4.21-1
    • 8.4.21-1~deb13u1
    • 8.4.22-1
    • 8.4.23-1
    • 8.4.23-1~deb13u1
    • 8.4.24-1~deb13u1
    Affected ranges
    • ECOSYSTEM: < 8.4.24-1

    Update to 8.4.24-1

  • php8.5 Ubuntu:26.04:LTS

    Versions
    • 8.5.2-0ubuntu1
    • 8.5.4-0ubuntu1
    • 8.5.4-0ubuntu1.1
    • 8.5.4-0ubuntu1.2
    Affected ranges
    • ECOSYSTEM: < 8.5.4-0ubuntu1.3

    Update to 8.5.4-0ubuntu1.3

Original sources

Check your server →