Integer Overflow Vulnerability in PHP Metaphone Function
CVE-2026-7568
6.3MEDIUM
What is CVE-2026-7568?
An integer overflow vulnerability exists in the metaphone() function of PHP versions prior to 8.2.31, 8.3.31, 8.4.21, and 8.5.6. When a string exceeding 2,147,483,647 bytes is processed, a signed integer overflow occurs, leading to undefined behavior. This can result in an out-of-bounds read which may cause a segmentation fault or unauthorized access to memory, compromising the stability and security of PHP processes.
Affected Version(s)
PHP 8.2.*
PHP 8.2.* < 8.2.31
PHP 8.3.* < 8.3.31
References
CVSS V4
Score:
6.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None
Timeline
Vulnerability published
Vulnerability Reserved
Credit
Aleksey Solovev (Positive Technologies)
Tim DĂĽsterhus