CVE-2026-17544

Out-of-bounds write in bccomp() via crafted operand and scale

Attacker-provided inputs to bccomp() could lead to an out-of-bounds write with stack and heap corruption in PHP versions from 8.4.* before 8.4.24 and from 8.5.* before 8.5.9.

We have discovered 593,473 live websites that are affected by CVE-2026-17544.

Run a Free Instant Scan



Affected Software

Product  PHP
Category Programming Languages
Vulnerable Domains593,473 live websites (8.41% of PHP install base)
Vulnerable Versions
  • from 8.4 through 8.4.24
  • from 8.5 through 8.5.9
Vulnerable Versions Count33 versions ( 6.26% of all versions)


Common Weakness Enumeration

CWE-787 Out-of-bounds Write



Details

  • Published - Jul 30, 2026
  • Updated - Jul 30, 2026

Credits

  • Recep Asan (finder)
  • Ilija Tovilo - The PHP Foundation (analyst)
  • Saki Takamachi - The PHP Foundation (remediation reviewer)

Website Distribution by Country

Number of websites using CVE-2026-17544
United States102,819 websites


Germany127,633 websites
France55,936 websites
Denmark54,615 websites
Netherlands39,499 websites
GB33,899 websites
Russia18,199 websites
Spain15,628 websites
Italy14,220 websites
Sweden13,060 websites

Website Distribution by TLD

Number of websites using CVE-2026-17544
.com183,205 websites
.de92,473 websites
.nl34,221 websites
.fr24,160 websites
.org22,771 websites
.co.uk22,072 websites
.se19,457 websites
.net16,507 websites
.dk16,360 websites
.ru16,276 websites

Vulnerable Versions

Vulnerable versions are highlighted in red

Websites affected by CVE-2026-17544

Top websites that are affected by CVE-2026-17544. Please click on the "Contact us" link to get more information.
DomainCountryRankContacts
***************.net United States***
**********.ca Canada*,***
*************.com United States*,***
*****.cz Czech Republic*,***
**.*******.io Germany*,***
*************.org United States*,***
****.org United States*,***
******.net United States*,***
****.com Germany*,***
*****.******.com Sweden*,***
See full domain list

FAQ

CVE-2026-17544 is Out-of-bounds Write in PHP
A total of 593,473 websites have been identified as vulnerable to CVE-2026-17544, based on global website indexing conducted by WebTechSurvey.
The PHP is affected by the CVE-2026-17544 vulnerability.
PHP versions up to 8.5.9 are vulnerable to CVE-2026-17544.
CVE-2026-17544 is resolved in version 8.5.9 of PHP.