Critical severity9.8NVD Advisory· Published Jul 30, 2026· Updated Aug 5, 2026
CVE-2026-17544
CVE-2026-17544
Description
Attacker-provided inputs to bccomp() could lead to an out-of-bounds write with stack and heap corruption in PHP versions from 8.4.* before 8.4.24 and from 8.5.* before 8.5.9.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
37- osv-coords35 versionspkg:bitnami/libphppkg:bitnami/phppkg:bitnami/php-minpkg:rpm/almalinux/php8.4pkg:rpm/almalinux/php8.4-bcmathpkg:rpm/almalinux/php8.4-clipkg:rpm/almalinux/php8.4-commonpkg:rpm/almalinux/php8.4-dbapkg:rpm/almalinux/php8.4-dbgpkg:rpm/almalinux/php8.4-develpkg:rpm/almalinux/php8.4-embeddedpkg:rpm/almalinux/php8.4-enchantpkg:rpm/almalinux/php8.4-ffipkg:rpm/almalinux/php8.4-fpmpkg:rpm/almalinux/php8.4-gdpkg:rpm/almalinux/php8.4-gmppkg:rpm/almalinux/php8.4-intlpkg:rpm/almalinux/php8.4-ldappkg:rpm/almalinux/php8.4-mbstringpkg:rpm/almalinux/php8.4-mysqlndpkg:rpm/almalinux/php8.4-odbcpkg:rpm/almalinux/php8.4-opcachepkg:rpm/almalinux/php8.4-pdopkg:rpm/almalinux/php8.4-pgsqlpkg:rpm/almalinux/php8.4-processpkg:rpm/almalinux/php8.4-snmppkg:rpm/almalinux/php8.4-soappkg:rpm/almalinux/php8.4-xmlpkg:rpm/opensuse/apache2-mod_php8&distro=openSUSE%20Leap%2016.0pkg:rpm/opensuse/php8&distro=openSUSE%20Leap%2016.0pkg:rpm/opensuse/php8&distro=openSUSE%20Tumbleweedpkg:rpm/opensuse/php8-embed&distro=openSUSE%20Leap%2016.0pkg:rpm/opensuse/php8-fastcgi&distro=openSUSE%20Leap%2016.0pkg:rpm/opensuse/php8-fpm&distro=openSUSE%20Leap%2016.0pkg:rpm/opensuse/php8-test&distro=openSUSE%20Leap%2016.0
>= 8.4.0, < 8.4.24+ 34 more
- (no CPE)range: >= 8.4.0, < 8.4.24
- (no CPE)range: >= 8.4.0, < 8.4.24
- (no CPE)range: >= 8.4.0, < 8.4.24
- (no CPE)range: < 8.4.24-1.el10_2
- (no CPE)range: < 8.4.24-1.el10_2
- (no CPE)range: < 8.4.24-1.el10_2
- (no CPE)range: < 8.4.24-1.el10_2
- (no CPE)range: < 8.4.24-1.el10_2
- (no CPE)range: < 8.4.24-1.el10_2
- (no CPE)range: < 8.4.24-1.el10_2
- (no CPE)range: < 8.4.24-1.el10_2
- (no CPE)range: < 8.4.24-1.el10_2
- (no CPE)range: < 8.4.24-1.el10_2
- (no CPE)range: < 8.4.24-1.el10_2
- (no CPE)range: < 8.4.24-1.el10_2
- (no CPE)range: < 8.4.24-1.el10_2
- (no CPE)range: < 8.4.24-1.el10_2
- (no CPE)range: < 8.4.24-1.el10_2
- (no CPE)range: < 8.4.24-1.el10_2
- (no CPE)range: < 8.4.24-1.el10_2
- (no CPE)range: < 8.4.24-1.el10_2
- (no CPE)range: < 8.4.24-1.el10_2
- (no CPE)range: < 8.4.24-1.el10_2
- (no CPE)range: < 8.4.24-1.el10_2
- (no CPE)range: < 8.4.24-1.el10_2
- (no CPE)range: < 8.4.24-1.el10_2
- (no CPE)range: < 8.4.24-1.el10_2
- (no CPE)range: < 8.4.24-1.el10_2
- (no CPE)range: < 8.4.24-160000.1.1
- (no CPE)range: < 8.4.24-160000.1.1
- (no CPE)range: < 8.5.9-1.1
- (no CPE)range: < 8.4.24-160000.1.1
- (no CPE)range: < 8.4.24-160000.1.1
- (no CPE)range: < 8.4.24-160000.1.1
- (no CPE)range: < 8.4.24-160000.1.1
Patches
Vulnerability mechanics
References
1- github.com/php/php-src/security/advisories/GHSA-x692-q9x7-8c3fnvdVendor Advisory
News mentions
2- PHP: Three Vulnerabilities Including SQLi and Memory Corruption Disclosed TogetherVypr Intelligence · Jul 31, 2026
- PHP Patches Three Flaws Enabling SQL Injection, Memory Corruption and Server CrashesCyber Security News · Jul 31, 2026