Out-of-Bounds Write in PHP via bccomp()

Executive Summary

CVE-2026-17544 is a high-severity vulnerability in PHP's ext-bcmath extension affecting the bccomp() function. It allows an out-of-bounds write attack when processing crafted inputs due to improper handling of the fractional_end pointer in bc_str2num(). This causes buffer overflow leading to stack or heap corruption.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check your PHP version using 'php -v'. If your version is 8.4.* before 8.4.24 or 8.5.* before 8.5.9, the system is vulnerable. Inspect applications using the ext-bcmath extension, particularly those calling bccomp(). Enable PHP error logging to detect crashes or memory corruption during input processing.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to execute arbitrary code, crash applications, or gain unauthorized access to systems running vulnerable PHP versions before 8.4.24 or 8.5.9. It may also enable data theft or system compromise depending on the application's context.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating GDPR's integrity and confidentiality principles or HIPAA's security requirements. Organizations must patch systems to maintain compliance and prevent potential regulatory penalties.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade PHP to version 8.4.24 or later, or 8.5.9 or later, depending on your branch. If upgrading is not possible, disable the ext-bcmath extension in php.ini by setting 'extension=bcmath' to ';extension=bcmath'. Monitor logs for signs of exploitation attempts targeting bccomp().

Useful 0 Not Useful 0