CVE-2026-7568

Description

In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the metaphone() function in ext/standard/metaphone.c uses a signed int variable to track the current position within the input string. If a string longer than 2,147,483,647 bytes is passed, a signed integer overflow occurs, resulting in undefined behavior. This can lead to an out-of-bounds read, causing a segmentation fault or access to unrelated memory, and may affect the availability of the PHP process.

How to fix CVE-2026-7568

To remediate CVE-2026-7568, upgrade the affected package to a fixed version below.

• —upgrade to 8.2.31 or later
• —upgrade to 8.2.31 or later
• —upgrade to 8.2.31 or later
• —upgrade to 7.4.33-1+deb11u11 or later
• —upgrade to 8.2.31-1~deb12u1 or later
• —upgrade to 8.4.21-1~deb13u1 or later

Is CVE-2026-7568 being exploited?

Low — EPSS is 0.1%, meaning exploitation activity has not been observed at scale.

Affected packages (6)

• >= 8.2.0, < 8.2.31, >= 8.3.0, < 8.3.31, >= 8.4.0, < 8.4.21, >= 8.5.0, < 8.5.6
• >= 8.2.0, < 8.2.31, >= 8.3.0, < 8.3.31, >= 8.4.0, < 8.4.21, >= 8.5.0, < 8.5.6
• >= 8.2.0, < 8.2.31, >= 8.3.0, < 8.3.31, >= 8.4.0, < 8.4.21, >= 8.5.0, < 8.5.6
• from 0, < 7.4.33-1+deb11u11
• from 0, < 8.2.31-1~deb12u1
• from 0, < 8.4.21-1~deb13u1

CVSS scores

References (3)

• ADVISORYsecurity-tracker.debian.org/tracker/CVE-2026-7568
• WEBgithub.com/php/php-src/security/advisories/GHSA-96wq-48vp-hh57
• WEBnvd.nist.gov/vuln/detail/CVE-2026-7568