The vulnerability CVE-2026-7568 involves a signed integer overflow in the metaphone() function within PHP's ext/standard/metaphone.c. Specifically, a signed int variable used to track the current position in the input string can overflow if the input string exceeds 2,147,483,647 bytes. This overflow leads to undefined behavior, including out-of-bounds memory reads, which may cause segmentation faults or access to unrelated memory regions. The vulnerability affects PHP versions 8.2.0 up to but not including 8.2.31, 8.3.0 up to but not including 8.3.31, 8.4.0 up to but not including 8.4.21, and 8.5.0 up to but not including 8.5.6. Red Hat has released security updates for their Enterprise Linux distributions that include fixes for this issue.

Exploitation of this vulnerability can cause a denial of service by crashing the PHP process due to out-of-bounds memory access resulting from the integer overflow. This affects the availability of applications relying on the vulnerable PHP versions. There is no indication of code execution or data disclosure from the provided information.

Security updates addressing CVE-2026-7568 have been released by Red Hat for affected PHP versions. Users should apply the official patches provided in these updates to remediate the vulnerability. Patch status is confirmed by vendor advisories. No additional mitigation actions are specified or required beyond applying the official fixes.