CVE-2026-17544 is a critical (CVSS 9.8) out-of-bounds write in the PHP BCMath function bccomp(). Attacker-supplied inputs can corrupt stack or heap memory. It affects PHP 8.4 before 8.4.24 and 8.5 before 8.5.9. Upgrade to a fixed version, and review code that passes untrusted numbers to bccomp.
What's affected
PHP 8.4 before 8.4.24 and PHP 8.5 before 8.5.9. The record does not list the 8.2 or 8.3 branches for this CVE, which differs from the companion SQL injection, CVE-2026-17543.
The bug is in bc_str2num() in the BCMath library bundled with PHP, reached through bccomp(). Distributions may backport fixes without changing version numbers, so check your distribution's advisory as well.
How to check if you're exposed
Check the PHP version and whether BCMath is loaded.
php -v
php -m | grep -i bcmath
Then search for places where outside input reaches bccomp(), directly or through other BCMath functions that take a scale.
grep -rn "bccomp(" --include=*.php .
Money handling, pricing and cryptographic code often use BCMath, so look there first. Check images and lock files too, because the PHP runtime often comes from a base image.
What to do now
- List PHP 8.4 and 8.5 installations, including base and CI images.
- Upgrade to 8.4.24 or 8.5.9 or later, or to a distribution package that carries the fix.
- Find code that passes request data to bccomp and validate it as a number of sensible length first.
- Rebuild and redeploy images, then rescan them.
- Watch for crashes in PHP workers, which can be a sign of memory errors.
Why it matters
The weakness is CWE-787 (Out-of-bounds Write) for the write itself, and the advisory tags it as a stack-based buffer overflow. The function bc_str2num() shortens a number's scale and then trims trailing zeros from the fractional part, but it did not move the end pointer to match. The copy step then used the original, longer length and wrote into a buffer sized for the shorter one.
BCMath keeps small numbers in a stack arena before it falls back to the heap, so the overflow can corrupt either place. The fix adds one line that updates the end pointer after the zeros are trimmed. The vector shows no login, low complexity and no user interaction, with high impact on all three goals. CISA does not list this CVE as known exploited.
Try it yourself
This demo shows how to find a vulnerable component and move to the fixed release quickly.
Click through it at your own pace, or open it full screen.
Quick check
Do 8.2 and 8.3 need this fix?
The record lists only 8.4 before 8.4.24 and 8.5 before 8.5.9 for this CVE. The PHP advisory is the place to confirm if that changes.
Sources
Last reviewed: 19 October 2026.
