# CVE-2026-7568: PHP signed integer overflow in metaphone function

Source: https://junglewise.ai/threats/cve-2026-7568-php-signed-integer-overflow-in-metaphone-function  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-10. Updated: 2026-06-30  
License: CC BY 4.0 with a link back

CVE-2026-7568 · Severity: high · CVSS 7.5 · Published 2026-05-10

A vulnerability exists in PHP, a widely used web programming language, specifically within its word-matching 'metaphone' function. An attacker can trigger a system crash or cause the application to stop responding by providing an extremely large string of text. This could lead to service outages for websites or applications that process user-supplied text through this specific function.

Technologies: [PHP Group PHP](https://junglewise.ai/threats/technologies/php), [Red Hat Enterprise Linux AppStream](https://junglewise.ai/threats/technologies/enterprise-linux-appstream). Vendors: [PHP Group](https://junglewise.ai/threats/vendors/php-group), [Red Hat](https://junglewise.ai/threats/vendors/red-hat).

## Quick answers

**Is CVE-2026-7568 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-7568 being exploited in the wild.

**How severe is CVE-2026-7568?** High severity, with a CVSS score of 7.5, published 10 May 2026.

**Which products and versions are affected?** PHP Group PHP 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, 8.5.* before 8.5.6.

**Is there a fix for CVE-2026-7568?** A patch was published on 2026-06-01: Red Hat released security updates for RHEL 9 (RHSA-2026:22142, RHSA-2026:22143) Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-7568 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-7568?** Check whether you run PHP Group PHP or Red Hat Enterprise Linux AppStream at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A signed integer overflow vulnerability exists in the metaphone() function within ext/standard/metaphone.c of the PHP interpreter. The function uses a signed 32-bit integer (w_idx) to track the current position within the input string; if a string longer than 2,147,483,647 bytes is processed, the index can wrap around, leading to undefined behavior. This results in an out-of-bounds read (CWE-125) which typically causes a segmentation fault (DoS) or potentially allows access to unrelated memory. The vulnerability is reachable if an application passes untrusted, large-scale string input to the metaphone() function. Patches are available in PHP versions 8.2.31, 8.3.31, 8.4.21, and 8.5.6.

## Affected products

- PHP Group PHP 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, 8.5.* before 8.5.6
- Red Hat Red Hat Enterprise Linux AppStream (v. 8)
- Red Hat Red Hat Enterprise Linux AppStream (v. 9)
- Red Hat Red Hat Enterprise Linux AppStream (v. 10)

## Timeline

- 2026-05-07: advisory: PHP Group published security advisory GHSA-96wq-48vp-hh57
- 2026-05-10: disclosed: CVE-2026-7568 published
- 2026-06-01: patched: Red Hat released security updates for RHEL 9 (RHSA-2026:22142, RHSA-2026:22143)

## References

- [https://github.com/php/php-src/security/advisories/GHSA-96wq-48vp-hh57](https://github.com/php/php-src/security/advisories/GHSA-96wq-48vp-hh57)
- [https://access.redhat.com/errata/RHSA-2026:22142](https://access.redhat.com/errata/RHSA-2026:22142)
- [https://access.redhat.com/errata/RHSA-2026:22143](https://access.redhat.com/errata/RHSA-2026:22143)
- [https://access.redhat.com/errata/RHSA-2026:22305](https://access.redhat.com/errata/RHSA-2026:22305)
- [https://access.redhat.com/errata/RHSA-2026:22649](https://access.redhat.com/errata/RHSA-2026:22649)
- [https://access.redhat.com/errata/RHSA-2026:23388](https://access.redhat.com/errata/RHSA-2026:23388)
- [https://access.redhat.com/security/cve/CVE-2026-7568](https://access.redhat.com/security/cve/CVE-2026-7568)

## Related threats

- [PHP use-after-free in global state handling](https://junglewise.ai/threats/cve-2026-109619-php-has-various-global-state-that-temporarily-points-into)
- [PHP Memory Corruption Vulnerability](https://junglewise.ai/threats/cve-2026-109618-gcp-2026-070)
- [PHP Phar uncontrolled recursion in phar_get_link_source](https://junglewise.ai/threats/cve-2026-7260-php-phar-uncontrolled-recursion-in-phar-get-link-source)
- [PHP BCMath out-of-bounds write in bccomp](https://junglewise.ai/threats/cve-2026-17544-php-bcmath-out-of-bounds-write-in-bccomp)
- [PHP ext-pgsql SQL injection in pg_select and related functions](https://junglewise.ai/threats/cve-2026-17543-php-ext-pgsql-sql-injection-in-pg-select-and-related-functions)