CVE-2026-7568: Signed integer overflow in metaphone()
Fixed (Signed integer overflow of char array offset). (CVE-2026-7568)
Other sources
In PHP versions 8.2. before 8.2.31, 8.3. before 8.3.31, 8.4. before 8.4.21, and 8.5. before 8.5.6, the metaphone() function in ext/standard/metaphone.c uses a signed int variable to track the current position within the input string. If a string longer than 2,147,483,647 bytes is passed, a signed integer overflow occurs, resulting in undefined behavior. This can lead to an out-of-bounds read, causing a segmentation fault or access to unrelated memory, and may affect the availability of the PHP process.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 8.5.6 - Upgrade
Upgrade
debian/php7.4to a version that resolves this vulnerability.Fixed in 7.4.33-1+deb11u11 - Upgrade
Upgrade
debian/php8.2to a version that resolves this vulnerability.Fixed in 8.2.31-1~deb12u1 - Upgrade
Upgrade
debian/php8.4to a version that resolves this vulnerability.Fixed in 8.4.21-1~deb13u1Fixed in 8.4.21-1 - Upgrade
Upgrade
PHP metaphone() (ext/standard/metaphone.c)to a version that resolves this vulnerability.Fixed in 8.2.31 - Upgrade
Upgrade
PHP metaphone() (ext/standard/metaphone.c)to a version that resolves this vulnerability.Fixed in 8.3.31 - Upgrade
Upgrade
PHP metaphone() (ext/standard/metaphone.c)to a version that resolves this vulnerability.Fixed in 8.4.21 - Upgrade
Upgrade
PHP metaphone() (ext/standard/metaphone.c)to a version that resolves this vulnerability.Fixed in 8.5.6 - Compensating control
Ensure untrusted input cannot reach metaphone() with extremely long strings (greater than 2,147,483,647 bytes) to avoid triggering the signed integer overflow condition.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-7568?
CVE-2026-7568 is classified as critical due to the potential for signed integer overflow vulnerabilities affecting application execution.
Which versions of PHP are affected by CVE-2026-7568?
CVE-2026-7568 affects PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6.
How do I fix CVE-2026-7568?
To fix CVE-2026-7568, upgrade PHP to version 8.5.6 or later.
What function is vulnerable in CVE-2026-7568?
The vulnerable function in CVE-2026-7568 is metaphone() in ext/standard/metaphone.c.
What impacts does CVE-2026-7568 have on applications?
Applications using the metaphone() function may experience unintended behavior or security risks due to the signed integer overflow.