Skip to content

GHSA-x692-q9x7-8c3f on CTRL-OS 26.05

Aliases: GHSA-x692-q9x7-8c3f, CVE-2026-17544

Packages: php

Status: Plausible

Advisory Information

A call to bccomp() with attacker-supplied inputs can lead to an out-of-bounds write to either stack or heap memory. The bug occurs in bc_str2num() when the scale truncates a number whose trailing zeros are subsequently trimmed.

https://github.com/php/php-src/blob/a480965c90b4f4948f211c8b139788371e031838/ext/bcmath/libbcmath/src/str2num.c#L169-L185

str_scale later determines the number of digits after the decimal point in the resulting string.

https://github.com/php/php-src/blob/a480965c90b4f4948f211c8b139788371e031838/ext/bcmath/libbcmath/src/str2num.c#L203

The string is later populated using bc_copy_and_toggle_bcd(nptr, fractional_ptr, fractional_end).

https://github.com/php/php-src/blob/a480965c90b4f4948f211c8b139788371e031838/ext/bcmath/libbcmath/src/str2num.c#L213

Note that we have shortened the allocated string (str_scale -= fractional_end - fractional_new_end;) but have not adjusted fractional_end itself. Consequently, bc_copy_and_toggle_bcd(nptr, fractional_ptr, fractional_end) will copy the original, untruncated string into a buffer that is too small, leading to an out-of-bounds write.

BCMath uses a small stack-allocated arena for numbers before falling back to heap allocation, enabling both stack and heap corruption, depending on where the buffer is allocated.

The patch adds fractional_end = fractional_new_end; after the zero truncation.

Updates

2026-07-30 18:10 CEST

Metadata changes:

  • Status for package php: “Plausible”

(Amended on: 2026-07-30 18:11 CEST)

2026-07-30 17:57 CEST

Metadata changes:

  • Status for package php: “New”