Junglewise Threat Intelligence

CVE-2026-7568: PHP signed integer overflow in metaphone function

CVE-2026-7568 · Severity: high · CVSS 7.5 · Published 2026-05-10

Technologies: Red Hat Enterprise Linux AppStream, PHP Group PHP. Vendors: Red Hat, PHP Group.

Executive brief

A vulnerability exists in PHP, a widely used web programming language, specifically within its word-matching 'metaphone' function. An attacker can trigger a system crash or cause the application to stop responding by providing an extremely large string of text. This could lead to service outages for websites or applications that process user-supplied text through this specific function.

Technical details

A signed integer overflow vulnerability exists in the metaphone() function within ext/standard/metaphone.c of the PHP interpreter. The function uses a signed 32-bit integer (w_idx) to track the current position within the input string; if a string longer than 2,147,483,647 bytes is processed, the index can wrap around, leading to undefined behavior. This results in an out-of-bounds read (CWE-125) which typically causes a segmentation fault (DoS) or potentially allows access to unrelated memory. The vulnerability is reachable if an application passes untrusted, large-scale string input to the metaphone() function. Patches are available in PHP versions 8.2.31, 8.3.31, 8.4.21, and 8.5.6.

Affected products

  • PHP Group PHP 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, 8.5.* before 8.5.6
  • Red Hat Red Hat Enterprise Linux AppStream (v. 8)
  • Red Hat Red Hat Enterprise Linux AppStream (v. 9)
  • Red Hat Red Hat Enterprise Linux AppStream (v. 10)

Timeline

  • 2026-05-07: advisory: PHP Group published security advisory GHSA-96wq-48vp-hh57
  • 2026-05-10: disclosed: CVE-2026-7568 published
  • 2026-06-01: patched: Red Hat released security updates for RHEL 9 (RHSA-2026:22142, RHSA-2026:22143)

References

Related threats