CVE-2026-17544

Arbitrary code execution via out-of-bounds write in bccomp()

Publication Date 2026-07-30
Severity Critical
Type Remote Code Execution
Affected PHP Versions
  • 8.4.0-8.4.23
  • 8.5.0-8.5.8
Fixed Product Versions
  • ZendPHP 8.4
  • ZendPHP 8.5

CVE Details

Attacker-provided inputs to bccomp() could lead to an out-of-bounds write with stack and heap corruption in affected PHP versions. Such memory corruption can enable arbitrary code execution, allowing the attacker to take control of the affected system.

Recommendations

If you are using the BCMath extension and the bccomp() function, ensure that you filter values provided by users prior to passing them to the function.

If you are on an affected PHP version and using the BCMath extension, we recommend updating to a patched version immediately.