CVE-2026-7568 Signed integer overflow in metaphone()
An attacker can cause a denial of service in PHP applications by passing an excessively long string to the metaphone function, triggering an integer overflow and crash.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-7568?
CVE-2026-7568 is a medium-severity vulnerability in Php Php, published on 10 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the metaphone() function in ext/standard/metaphone.c uses a signed int variable to track the current position within the input string. If a string longer than 2,147,483,647 bytes is passed, a signed integer overflow occurs, resulting in undefined behavior. This can lead to an out-of-bounds read, causing a segmentation fault or access to unrelated memory, and may affect the availability of the PHP process.
Which versions are affected by CVE-2026-7568?
3 open source packages ship an affected version, including libphp, php and php-min. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
libphp Bitnami | From 8.2.0 | 8.2.31, 8.3.31, 8.4.21, 8.5.6 |
php Bitnami | From 8.2.0 | 8.2.31, 8.3.31, 8.4.21, 8.5.6 |
php-min Bitnami | From 8.2.0 | 8.2.31, 8.3.31, 8.4.21, 8.5.6 |
Products include Php Php.
How do I fix CVE-2026-7568?
Upgrade libphp to a fixed version for your release line: 8.2.31, 8.3.31, 8.4.21 or 8.5.6.
Is CVE-2026-7568 being exploited?
There is no known exploitation of CVE-2026-7568 in the wild and no public exploit code.
Other vulnerabilities in Php Php
Sources
Also known as AZL-86361, BELL-CVE-2026-7568, BIT-libphp-2026-7568, BIT-php-2026-7568, BIT-php-min-2026-7568, DEBIAN-CVE-2026-7568 and 6 more.