CVE-2026-7568

Overview

PHP is a general-purpose scripting language used mostly for web development. It runs behind web servers through server APIs such as Apache mod_php and PHP-FPM, and powers content management systems and frameworks such as WordPress, Drupal, Moodle and Laravel.

An Out-of-Bounds Read vulnerability (CVE-2026-7568) has been identified in the metaphone() function of PHP's standard extension, which allows an attacker who can pass a string longer than 2 GiB to metaphone() to overflow the signed integer that tracks the position in the string, so that PHP reads memory outside the string and may crash. PHP tracks this issue as GHSA-96wq-48vp-hh57.

Per MITRE CWE-125: The product reads data past the end, or before the beginning, of the intended buffer.

This issue affects PHP 7.0.0 through 8.2.30, PHP 8.3 before 8.3.31, PHP 8.4 before 8.4.21 and PHP 8.5 before 8.5.6.

Details

Module Info

• Product: PHP
• Affected packages: php-src (ext/standard)
• Affected versions: >=7.0.0 <8.2.31, >=8.3.0 <8.3.31, >=8.4.0 <8.4.21, >=8.5.0 <8.5.6
• GitHub repository: https://github.com/php/php-src
• Published packages: https://www.php.net/downloads
• Package manager: N/A
• Fixed in:
  • OSS PHP 8.2.31, 8.3.31, 8.4.21, 8.5.6
  • NES for PHP 7.2.1 (based on PHP 7.2.34)
  • NES for PHP 7.4.1 (based on PHP 7.4.33)

Vulnerability Info

This Medium-severity vulnerability is found in the standard extension of PHP 7.0.0 through 8.2.30, PHP 8.3 before 8.3.31, 8.4 before 8.4.21 and 8.5 before 8.5.6, including the End-of-Life PHP 7.0, 7.1, 7.2, 7.3, 7.4, 8.0 and 8.1 release lines, which never received the upstream fix. The PHP project scores it 6.3 under CVSS 4.0 (CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/RE:L/U:Amber) and classifies it as CWE-190 (integer overflow) and CWE-125 (out-of-bounds read).

metaphone() computes a phonetic key for a word, for example to find names that sound alike. It walks the input one character at a time and reads the current and neighboring characters through macros such as Curr_Letter, which expands to toupper(word[w_idx]). The string length is a size_t, but the position w_idx is a signed int. In PHP 7.4.33 the function begins:

static int metaphone(unsigned char *word, size_t word_len, zend_long max_phonemes, zend_string **phoned_word, int traditional)
{
    int w_idx = 0; /* point in the phonization we're at. */
    size_t p_idx = 0; /* end of the phoned phrase */ 

When the input is longer than 2,147,483,647 bytes, incrementing w_idx past that value is a signed integer overflow, which is undefined behavior in C. In practice the index can become negative, and word[w_idx] then reads memory before the string. The CVE record states that this can cause a segmentation fault or access to unrelated memory and may affect the availability of the PHP process.

Exploitation needs a 64-bit build of PHP, an application that passes attacker-supplied input of at least 2 GiB to metaphone(), and a memory_limit (and, for request data, a post_max_size) that allows a string that large, which common settings do not. It works in any SAPI. Applications that do not call metaphone() on untrusted input, or that limit its length, are not affected.

The fix makes the position and the look-ahead counter size_t, matching the string length, and casts characters to unsigned char before passing them to toupper() and isalpha(). In PHP 8.2.31 the declaration reads:

size_t w_idx = 0; /* point in the phonization we're at. */ 

Mitigation

The PHP project publishes security fixes only for its supported release lines. PHP 7.0, 7.1, 7.2, 7.3, 7.4, 8.0 and 8.1 are End-of-Life and will not receive any public updates to address this issue.

Users of the affected components should apply one of the following mitigations:

• Upgrade to PHP 8.2.31, 8.3.31, 8.4.21, 8.5.6, or later.
• Leverage a commercial support partner like HeroDevs (NES for PHP) for post-EOL security support.

Credits

• Aleksey Solovev (Positive Technologies) (finder)
• Tim Düsterhus (remediation)