Fluid Attacks Database

Description

Attacker-provided inputs to bccomp() could lead to an out-of-bounds write with stack and heap corruption in PHP versions from 8.4.* before 8.4.24 and from 8.5.* before 8.5.9.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
debian 14	php8.4	=8.4.11-1 \|\| =8.4.16-1 \|\| =8.4.16-1~deb13u1 \|\| =8.4.20-1 \|\| =8.4.21-1 \|\| =8.4.21-1~deb13u1 \|\| =8.4.22-1 \|\| =8.4.23-1 \|\| =8.4.23-1~deb13u1 \|\| =8.4.24-1~deb13u1 \|\| >=0 <8.4.24-1	8.4.24-1
rpm rhel6	php	-	-
rpm rhel10	php8.4	<0:8.4.24-1.el10_2	0:8.4.24-1.el10_2
debian 13	php8.4	=8.4.11-1 \|\| =8.4.16-1 \|\| =8.4.16-1~deb13u1 \|\| =8.4.20-1 \|\| =8.4.21-1 \|\| =8.4.21-1~deb13u1 \|\| =8.4.22-1 \|\| =8.4.23-1 \|\| =8.4.23-1~deb13u1 \|\| >=0 <8.4.24-1~deb13u1	8.4.24-1~deb13u1

Aliases

1. CVE-2026-175442. NVD-2026-175443. OSV-DEBIAN-2026-175444. OSV-2026-175445. SECURITY-TRACKER-CVE-2026-17544

References

1. https://github.com/Boreas37/CVE-2026-17544-PoC

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.