Free and open · new CVEs checked every 20 minutesStatusRSSOpen dataContact

CVE-2026-17544: Attacker-provided inputs to bccomp() could lead to an out-of-bounds write with stack and heap corruption in PH

56
This week
CRITICAL 9.8REMOTEUPGRADE

CVE-2026-17544 is a critical-severity flaw (CVSS 9.8) affecting php. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

Attacker-provided inputs to bccomp() could lead to an out-of-bounds write with stack and heap corruption in PHP versions from 8.4.* before 8.4.24 and from 8.5.* before 8.5.9.

Why this priority

  • Critical severity
  • Public exploit reference
  • CISA SSVC: automatable with total technical impact
  • Remotely exploitable, no login, no user action

A fixed release or distro patch exists.

Risk facts

CVSS score9.8 (Critical)
Attack vectorNetwork (remote)
Attack complexityLow
Privileges neededNone
User interactionNone
EPSS exploit chance0.4% (top 65%)
CISA exploited listNo
WeaknessCWE-787
Published2026-07-30
Last modified2026-10-23
Publisher (CNA): PHP Group · Vendor: php

Am I affected?

Timeline

php php UPGRADE
Affected: >= 8.4.0 and < 8.4.24 · >= 8.5.0 and < 8.5.9
Fixed in: 8.4.24, 8.5.9
Safe to downgrade to: a release before 8.4.0
1. Check installed version
apt-cache policy php || rpm -q php || php --version
2. UPGRADE to 8.4.24 (Debian / Ubuntu)
sudo apt update && sudo apt install --only-upgrade php
2. UPGRADE (RHEL / Amazon Linux / Fedora)
sudo dnf upgrade php
Note
Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.
3. If no update is available yet, DOWNGRADE to a release before 8.4.0 (Debian / Ubuntu)
apt-cache madison php sudo apt install php=<VERSION_BEFORE_8.4.0> sudo apt-mark hold php
3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list php sudo dnf downgrade php-<VERSION_BEFORE_8.4.0> sudo dnf versionlock add php
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.

Exact fixes by distribution

Fedora 46 · python-fontconfig · FIXED · 0.6.3-1.fc46 · FEDORA-2026-f92ca8b01f · source
sudo dnf upgrade --advisory=FEDORA-2026-f92ca8b01f
Fedora ELN · valgrind · FIXED · 3.28.0-1.eln159 · FEDORA-2026-c593ef1d15 · source
sudo dnf upgrade --advisory=FEDORA-2026-c593ef1d15
Ubuntu 20.04 · php7.4 · NOT AFFECTED
Ubuntu 22.04 · php8.1 · NOT AFFECTED
Ubuntu 24.04 · php8.3 · NOT AFFECTED
Debian 12 · php8.2 · NOT AFFECTED
Debian 13 · php8.4 · FIXED · 8.4.24-1~deb13u1
sudo apt update && sudo apt install --only-upgrade php8.4 dpkg --compare-versions "$(dpkg-query -W -f='${Version}' php8.4)" ge "8.4.24-1~deb13u1" && echo PATCHED || echo STILL-VULNERABLE
RHEL 10 · php8.4 · FIXED · php8.4-8.4.24-1.el10_2
sudo dnf upgrade --advisory=RHSA-2026:56969 rpm -q php8.4
RHEL 10 · php · NOT AFFECTED
RHEL 6 · php · DEFERRED
RHEL 7 · php · NOT AFFECTED
RHEL 8 · php:7.4/php · NOT AFFECTED
Alpine 3.22 · php84 · FIXED · php84-8.4.27-r0
apk add --upgrade php84 apk info -v php84
Alpine 3.23 · php84 · FIXED · php84-8.4.27-r0
apk add --upgrade php84 apk info -v php84
Alpine 3.23 · php85 · FIXED · php85-8.5.12-r0
apk add --upgrade php85 apk info -v php85
Alpine 3.24 · php84 · FIXED · php84-8.4.24-r0
apk add --upgrade php84 apk info -v php84
Amazon Linux 2023 · see advisory · FIXED · ALAS2023-2026-2042 · source
sudo dnf update --advisory=ALAS2023-2026-2042

Public exploits and detection

Public code exists for this CVE. Treat unpatched systems as at risk, and only run PoCs in a lab.

Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Related CVEs

References

← Back to latest CVEs