UpHeron
All vulnerabilities

Servers and applications

CVE-2026-17544

Attacker-provided inputs to bccomp() could lead to an out-of-bounds write with stack and heap corruption in PHP versions from 8.4.* before 8.4.24 and from 8.5.* before 8.5.9.

Severity
High 8.1
Published
30 Jul 2026
Last changed
5 Aug 2026
Added to UpHeron
14 Oct 2026
Fixed in
8.4.24, 8.5.9
Sources
NVD

Affected software

SoftwareAffected versions
PHPServers and applications · cpe:a:php:php
  • From 8.4.0 before 8.4.24
  • From 8.5.0 before 8.5.9

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2026-17544
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2026-17544