CVE-2026-91767: Buffer Overflow
Published Sep 24, 2026
·Updated
Fixed (Heap buffer overflow in phpopensslmatcheswildcardname() on crafted server certificate wildcard CN). (CVE-2026-91767)
Affected Software
1 affected componentFixes available
PHP PHP<8.4.26
8.4.26
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 8.4.26
Event History
Sep 24, 2026
CVE Published
via PHP·12:00 AM
Data Sourced
via PHP·12:00 AM
DescriptionAffected Software
Frequently Asked Questions
1
What input is involved in triggering the overflow?
The issue is triggered by a crafted server certificate containing a wildcard common name (CN).
2
Which PHP component contains the vulnerable code?
The overflow is in php_openssl_matches_wildcard_name(), indicating the affected code is part of PHP's OpenSSL-related certificate hostname wildcard matching.
3
Is the vulnerability fixed?
Yes. The provided information states that the heap buffer overflow is fixed, and references the PHP 8.3.35 changelog.