CVE-2026-17544 is a critical vulnerability in PHP's bccomp() function that allows a remote attacker to cause an out-of-bounds write, resulting in stack and heap corruption. This memory corruption can lead to arbitrary code execution, compromising the affected system. The flaw affects PHP versions 8.4 and 8.5 streams as shipped in Red Hat Enterprise Linux 10 and Red Hat In-Vehicle OS 2.0.z. Red Hat has issued updated PHP RPM packages (version 8.5.9-1.hum1) for multiple PHP components to fix this issue. The vulnerability is classified under CWE-787 (Out-of-bounds Write) and CWE-89 (SQL Injection is listed but not detailed in the advisory). Exploitation requires high attack complexity but no privileges or user interaction. Red Hat's advisory states no effective mitigations exist other than applying the update. The vendor advisory is the authoritative source for patch status and impact.

Successful exploitation of this vulnerability can lead to arbitrary code execution on affected systems, allowing an attacker to take full control. The flaw causes memory corruption (stack and heap), which can also result in denial of service through crashes. The attack vector is network-based with no privileges or user interaction required, but the attack complexity is high. This makes the vulnerability critical in severity.

Red Hat has released updated PHP RPM packages (version 8.5.9-1.hum1) that fix this vulnerability. Applying these updates to the affected PHP packages in Red Hat Hardened Images is the recommended remediation. No other mitigations meeting Red Hat's criteria for ease of use, applicability, and stability are currently available. Users should follow Red Hat's official update instructions at https://images.redhat.com/ to apply the fix.