# CVE-2026-17544: PHP BCMath out-of-bounds write in bccomp

Source: https://junglewise.ai/threats/cve-2026-17544-php-bcmath-out-of-bounds-write-in-bccomp  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-30. Updated: 2026-07-30  
License: CC BY 4.0 with a link back

CVE-2026-17544 · Severity: info · CVSS 8.1 · Published 2026-07-30

A vulnerability exists in PHP's BCMath extension, which is used for high-precision mathematical calculations. An attacker can provide specially crafted inputs to certain math functions to crash the application or potentially execute unauthorized code. This could lead to a total compromise of the server's data and availability.

Technologies: [PHP Group PHP](https://junglewise.ai/threats/technologies/php). Vendors: [PHP Group](https://junglewise.ai/threats/vendors/php-group).

## Quick answers

**Is CVE-2026-17544 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-17544 being exploited in the wild.

**How severe is CVE-2026-17544?** Informational severity, with a CVSS score of 8.1, published 30 July 2026.

**Which products and versions are affected?** PHP Group PHP 8.4.* before 8.4.24, 8.5.* before 8.5.9.

**Is there a fix for CVE-2026-17544?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-17544 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-17544?** Check whether you run PHP Group PHP at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An out-of-bounds write vulnerability exists in the bc_str2num() function within PHP's BCMath extension (ext-bcmath). The flaw occurs when a user-provided scale truncates a number and trailing zeros are subsequently trimmed; the code fails to update the 'fractional_end' pointer after adjusting 'str_scale'. When bc_copy_and_toggle_bcd() is later called, it copies the original untruncated string into a buffer sized for the truncated version. Depending on the size of the input, this results in either stack-based or heap-based memory corruption. The issue is fixed in PHP versions 8.4.24 and 8.5.9.

## Affected products

- PHP Group PHP 8.4.* before 8.4.24, 8.5.* before 8.5.9

## Timeline

- 2026-07-30: advisory
- 2026-07-30: disclosed

## References

- [https://github.com/php/php-src/security/advisories/GHSA-x692-q9x7-8c3f](https://github.com/php/php-src/security/advisories/GHSA-x692-q9x7-8c3f)

## Related threats

- [PHP use-after-free in global state handling](https://junglewise.ai/threats/cve-2026-109619-php-has-various-global-state-that-temporarily-points-into)
- [PHP Memory Corruption Vulnerability](https://junglewise.ai/threats/cve-2026-109618-gcp-2026-070)
- [PHP Phar uncontrolled recursion in phar_get_link_source](https://junglewise.ai/threats/cve-2026-7260-php-phar-uncontrolled-recursion-in-phar-get-link-source)
- [PHP ext-pgsql SQL injection in pg_select and related functions](https://junglewise.ai/threats/cve-2026-17543-php-ext-pgsql-sql-injection-in-pg-select-and-related-functions)
- [PHP OpenSSL extension heap overflow in AES-WRAP-PAD](https://junglewise.ai/threats/cve-2026-14355-php-openssl-extension-heap-overflow-in-aes-wrap-pad)