CVE-2026-17544: 
PHP vulnerability analysis and mitigation

CVE-2026-17544 is a high-severity out-of-bounds write vulnerability in PHP's BCMath extension (bccomp() function) that allows unauthenticated remote attackers to corrupt stack or heap memory. It affects PHP versions 8.4.0 through 8.4.23 and 8.5.0 through 8.5.8, with fixes available in 8.4.24 and 8.5.9. The vulnerability was published on July 30, 2026, and carries a CVSS v3.1 base score of 9.8 (Critical) and a CVSS v4.0 base score of 8.1 (High) (PHP Advisory).

The root cause is an out-of-bounds write (CWE-787 / CWE-121 Stack-based Buffer Overflow) in bc_str2num() within ext/bcmath/libbcmath/src/str2num.c. When bccomp() is called with a crafted operand and scale, the function truncates trailing zeros from the fractional part and reduces str_scale accordingly, but fails to update fractional_end to match the new boundary. As a result, bc_copy_and_toggle_bcd() copies the original, untruncated string into an undersized buffer, writing beyond its end. Because BCMath uses a small stack-allocated arena before falling back to heap allocation, the overflow can corrupt either stack or heap memory depending on the size of the input. The fix adds fractional_end = fractional_new_end; after the zero-truncation step (PHP Advisory).

Successful exploitation can result in arbitrary code execution or denial of service due to stack and heap memory corruption. An unauthenticated network attacker can trigger the vulnerability by supplying malicious inputs to any PHP application that passes user-controlled data to bccomp(), with no user interaction required. The full confidentiality, integrity, and availability of the affected server are at risk, and exploitation could enable lateral movement within a compromised environment (PHP Advisory, Feedly).

As of the time of reporting, no public proof-of-concept exploit was initially observed; however, a PoC repository (github.com/Boreas37/CVE-2026-17544-PoC) appeared on GitHub approximately two weeks after disclosure, and a reference was indexed by Sploitus (Feedly). The EPSS score is approximately 0.43%, indicating a currently low but non-negligible probability of exploitation in the wild. NVD SSVC assessment notes the vulnerability is automatable with total technical impact, though no active in-the-wild exploitation has been confirmed and it is not listed in the CISA KEV catalog. CVSS v4.0 exploit maturity is rated "Unreported" (Feedly).

1. Reconnaissance: Identify internet-facing PHP applications (versions 8.4.0–8.4.23 or 8.5.0–8.5.8) that accept user-supplied numeric inputs processed by bccomp(), using tools like Shodan, Censys, or manual application enumeration.
2. Craft malicious input: Construct a numeric string operand with a fractional part whose trailing zeros, when truncated by a manually specified scale parameter, cause str_scale to be decremented without a corresponding adjustment to fractional_end in bc_str2num().
3. Submit payload: Send the crafted input to the target application endpoint (e.g., via HTTP POST/GET parameters) that passes attacker-controlled values directly or indirectly to bccomp($attacker_input, $value, $scale).
4. Trigger out-of-bounds write: The PHP runtime calls bc_copy_and_toggle_bcd() with the original fractional_end pointer but a buffer sized for the truncated length, writing beyond the allocated buffer on the stack or heap.
5. Achieve code execution or crash: Depending on memory layout, the overflow corrupts adjacent stack frames or heap metadata, potentially enabling arbitrary code execution or causing a denial-of-service crash of the PHP process (PHP Advisory).

• Network: Unusual or repeated HTTP requests containing numeric strings with long fractional parts and explicit scale parameters targeting endpoints known to use BCMath functions; unexpected outbound connections from the PHP/web server process.
• Logs: PHP error logs showing segmentation faults, memory corruption errors, or unexpected process crashes (SIGSEGV, SIGABRT) in the web server or PHP-FPM process; access logs with anomalous numeric parameter values.
• Process: Unexpected child processes spawned by the PHP-FPM or web server worker (e.g., shells, curl, wget); PHP worker processes crashing and restarting repeatedly.
• File System: Unexpected new files (web shells, scripts) written to web-accessible directories by the PHP process user account.

Upgrade PHP to version 8.4.24 (for 8.4.x users) or 8.5.9 (for 8.5.x users), which contain the patch adding fractional_end = fractional_new_end; to bc_str2num() (PHP Advisory). As an interim measure, restrict or sanitize user-supplied inputs before passing them to bccomp(), or disable the BCMath extension if it is not required by the application. Linux distribution packages (Fedora, RHEL, Debian, SUSE, openSUSE, Slackware) have also released updated PHP packages incorporating these fixes (Feedly).

Security news outlets including CyberSecurityNews, GBHackers, CyberPress, and Cryptika covered the PHP security release, noting the trio of critical flaws (SQL injection, memory corruption, and server crashes) patched in the July 2026 update. The Remi repository blog and Linux distribution communities (Fedora, SUSE, Debian, Slackware) promptly published updated packages. Community sentiment reflected urgency around upgrading given the critical CVSS score and the potential for remote code execution without authentication (CyberSecurityNews, GBHackers, Remi Blog).