This vulnerability (CVE-2026-17544) in PHP arises from improper handling of inputs to the bccomp() function, leading to an out-of-bounds write condition. The flaw affects PHP versions starting from 8.4.0 up to but not including 8.4.24, and from 8.5.0 up to but not including 8.5.9. The out-of-bounds write can corrupt stack and heap memory, which may result in unpredictable behavior or crashes. The CVSS 4.0 base score is 8.1, indicating a high severity with network attack vector, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. There is no information about known exploits in the wild or an official patch at this time.

Successful exploitation of this vulnerability could lead to memory corruption including stack and heap corruption, potentially allowing an attacker to cause application crashes or execute arbitrary code. The high CVSS score reflects significant impact on confidentiality, integrity, and availability without requiring privileges or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider avoiding use of the bccomp() function with untrusted input or apply other protective measures such as input validation or runtime protections. Monitor vendor channels for updates.