This vulnerability (CWE-787) arises from improper handling of inputs in the bccomp() function in PHP. Specifically, attacker-supplied inputs can cause out-of-bounds writes, leading to corruption of stack and heap memory. The affected versions are PHP 8.4.* prior to 8.4.24 and PHP 8.5.* prior to 8.5.9. The CVSS 4.0 base score is 8.1, indicating a high severity with network attack vector, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability. No vendor advisory or patch links are provided, and the remediation level is not specified.

Successful exploitation can result in memory corruption (stack and heap), which may lead to application crashes, denial of service, or potentially arbitrary code execution. The vulnerability affects PHP installations running vulnerable versions, potentially impacting any application using the bccomp() function with attacker-controlled inputs.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, avoid processing untrusted inputs with the bccomp() function or apply other application-level input validation controls to mitigate risk.