CVE-2026-7568 Details

A signed integer overflow vulnerability has been identified in the PHP metaphone() function, part of the standard library. This issue affects PHP versions 8.2.* prior to 8.2.31, 8.3.* prior to 8.3.31, 8.4.* prior to 8.4.21, and 8.5.* prior to 8.5.6. The vulnerability arises because the function uses a signed int variable to track the current position in the input string. If a string longer than 2,147,483,647 bytes is provided, the overflow leads to undefined behavior. Exploiting this vulnerability can cause an out-of-bounds read, resulting in a segmentation fault or access to unrelated memory, potentially disrupting the PHP process.

Users can upgrade to PHP versions 8.2.31, 8.3.31, 8.4.21, or 8.5.6 to address this vulnerability.