CVE-2026-17544

A critical out-of-bounds write vulnerability in PHP's bccomp() function allows attackers to corrupt memory via attacker-provided inputs.

CVE-2026-17544 affects PHP versions 8.4.* before 8.4.24 and 8.5.* before 8.5.9, enabling stack and heap corruption through unvalidated inputs to the bccomp() function. DIB organizations must patch these versions immediately to prevent potential remote code execution or denial-of-service attacks, as memory corruption vulnerabilities are often exploited in the wild. The failure stems from insufficient input validation in the bccomp() implementation, highlighting the need for rigorous bounds checking in mathematical functions.

Shame score — A critical memory corruption vulnerability in a widely used programming language exposes all systems running unpatched PHP to exploitation, representing a severe avoidable failure in software development and patch management.