Is CVE-2026-7568 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-7568 being exploited in the wild.

How severe is CVE-2026-7568?

High severity, with a CVSS score of 7.5, published 10 May 2026.

Which products and versions are affected?

PHP Group PHP 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, 8.5.* before 8.5.6.

Is there a fix for CVE-2026-7568?

A patch was published on 2026-06-01: Red Hat released security updates for RHEL 9 (RHSA-2026:22142, RHSA-2026:22143) Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-7568 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-7568?

Check whether you run PHP Group PHP or Red Hat Enterprise Linux AppStream at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-7568: PHP signed integer overflow in metaphone function

CVE-2026-7568 · Severity: high · CVSS 7.5 · Published 2026-05-10

A vulnerability exists in PHP, a widely used web programming language, specifically within its word-matching 'metaphone' function. An attacker can trigger a system crash or cause the application to stop responding by providing an extremely large string of text. This could lead to service outages for websites or applications that process user-supplied text through this specific function.

Technologies: PHP Group PHP, Red Hat Enterprise Linux AppStream. Vendors: PHP Group, Red Hat.

Quick answers

Is CVE-2026-7568 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-7568 being exploited in the wild.
How severe is CVE-2026-7568?: High severity, with a CVSS score of 7.5, published 10 May 2026.
Which products and versions are affected?: PHP Group PHP 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, 8.5.* before 8.5.6.
Is there a fix for CVE-2026-7568?: A patch was published on 2026-06-01: Red Hat released security updates for RHEL 9 (RHSA-2026:22142, RHSA-2026:22143) Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-7568 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-7568?: Check whether you run PHP Group PHP or Red Hat Enterprise Linux AppStream at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A signed integer overflow vulnerability exists in the metaphone() function within ext/standard/metaphone.c of the PHP interpreter. The function uses a signed 32-bit integer (w_idx) to track the current position within the input string; if a string longer than 2,147,483,647 bytes is processed, the index can wrap around, leading to undefined behavior. This results in an out-of-bounds read (CWE-125) which typically causes a segmentation fault (DoS) or potentially allows access to unrelated memory. The vulnerability is reachable if an application passes untrusted, large-scale string input to the metaphone() function. Patches are available in PHP versions 8.2.31, 8.3.31, 8.4.21, and 8.5.6.

Affected products

PHP Group PHP 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, 8.5.* before 8.5.6
Red Hat Red Hat Enterprise Linux AppStream (v. 8)
Red Hat Red Hat Enterprise Linux AppStream (v. 9)
Red Hat Red Hat Enterprise Linux AppStream (v. 10)

Timeline

2026-05-07: advisory: PHP Group published security advisory GHSA-96wq-48vp-hh57
2026-05-10: disclosed: CVE-2026-7568 published
2026-06-01: patched: Red Hat released security updates for RHEL 9 (RHSA-2026:22142, RHSA-2026:22143)

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.