Logo
vulnerabilityCVE-2026-17544
Name
CVE-2026-17544
Source
NVD ( link)Debian ( link)
Description
Attacker-provided inputs to bccomp() could lead to an out-of-bounds write with stack and heap corruption in PHP versions from 8.4.* before 8.4.24 and from 8.5.* before 8.5.9.
Published Date
Updated Date
Workaround
-

Analysis#


Affected Component
Analysis
php8
Exploitable

Vulnerability Ratings#


8.1
CVSSv4
9.8
CVSSv31
NaN
other

Others affected components#


Name
Project
Project Version
Version
Status
buildroot
2025.02.x
8.3.33
Not Affected
buildroot
master
8.5.9
Not Affected
openwrt
openwrt-25.12
8.4.21-r1
Exploitable
yocto
kirkstone
8.1.34
Not Affected
yocto
master
8.5.9
Not Affected
yocto
scarthgap
8.2.33
Not Affected