CVE-2026-17545

Denial of Service via reserved device names on Windows

Publication Date 2026-09-25
Severity Moderate
Type Denial of Service
Affected PHP Versions
  • 7.2.0-7.2.34
  • 7.3.0-7.3.33
  • 7.4.0-7.4.33
  • 8.1.0-8.1.34
  • 8.2.0-8.2.33
  • 8.3.0-8.3.34
  • 8.4.0-8.4.25
  • 8.5.0-8.5.10
Fixed Product Versions
  • ZendPHP 7.2
  • ZendPHP 7.3
  • ZendPHP 7.4
  • ZendPHP 8.1
  • ZendPHP 8.2
  • ZendPHP 8.3
  • ZendPHP 8.4
  • ZendPHP 8.5
  • ZendServer 2021.4.8

CVE Details

On Windows, PHP's filesystem and stream APIs do not reject reserved device names such as CON, PRN, AUX, NUL, COM1 to COM9, LPT1 to LPT9, CONIN$ and CONOUT$ when they appear as a component of a path. An attacker-controlled filename therefore reaches CreateFileW() and opens a device instead of the regular file the application expected, which can block or hang the request and exhaust worker processes, resulting in a Denial of Service (DoS).

Recommendations

Never trust user input, particularly when it comes to filenames; ensure you are applying filter rules that will reject the various names listed in this vulnerability if you are deploying to Windows or developing libraries that could potentially deploy to Windows.

We recommend that if you deploy PHP to Windows and handle user-supplied filenames, you update to a patched version of PHP.