CVE-2026-17544

Name of the Vulnerable Software and Affected Versions PHP versions 8.4.0 through 8.4.23 PHP versions 8.5.0 through 8.5.8

Description Attacker-provided inputs to the bccomp() function can lead to an out-of-bounds write, resulting in stack and heap corruption. An out-of-bounds write occurs when a program writes data past the end of the intended buffer, potentially overwriting adjacent memory.

Recommendations Update PHP versions 8.4.0 through 8.4.23 to version 8.4.24. Update PHP versions 8.5.0 through 8.5.8 to version 8.5.9. As a temporary workaround, restrict the use of the bccomp() function until the updates are applied.