Vulnerability · Published May 10, 2026 · Assigned by php

CVE-2026-7568Signed integer overflow in metaphone()

High 7.5

In plain English

A high-severity integer overflow in PHP from PHP Group. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 40% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High
Exploit odds (30 days)0.5%top 60.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the metaphone() function in ext/standard/metaphone.c uses a signed int variable to track the current position within the input string. If a string longer than 2,147,483,647 bytes is passed, a signed integer overflow occurs, resulting in undefined behavior. This can lead to an out-of-bounds read, causing a segmentation fault or access to unrelated memory, and may affect the availability of the PHP process.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:8apcu-panel5.1.18-1.module_el8.6.0+2750+78feabcbALSA-2026:34354
AlmaLinux:8apcu-panel5.1.23-1.module_el8.10.0+3796+30ed3ef7ALSA-2026:22305
AlmaLinux:9apcu-panel5.1.23-1.module_el9.6.0+151+5f31e576ALSA-2026:22142
AlmaLinux:9apcu-panel5.1.23-1.module_el9.4.0+65+49ff6472ALSA-2026:22143
AlmaLinux:8libzip1.6.1-1.module_el8.6.0+2750+78feabcbALSA-2026:34354
AlmaLinux:8libzip1.6.1-1.module_el8.6.0+3239+bedf0508ALSA-2026:34354
AlmaLinux:8libzip1.6.1-1.module_el8.10.0+3935+28808425ALSA-2026:34354
AlmaLinux:8libzip1.7.3-1.module_el8.10.0+3796+30ed3ef7ALSA-2026:22305
AlmaLinux:8libzip-devel1.7.3-1.module_el8.10.0+3796+30ed3ef7ALSA-2026:22305
AlmaLinux:8libzip-devel1.6.1-1.module_el8.6.0+3239+bedf0508ALSA-2026:34354
AlmaLinux:8libzip-devel1.6.1-1.module_el8.10.0+3935+28808425ALSA-2026:34354
AlmaLinux:8libzip-tools1.6.1-1.module_el8.6.0+2750+78feabcbALSA-2026:34354
AlmaLinux:8libzip-tools1.6.1-1.module_el8.6.0+3239+bedf0508ALSA-2026:34354
AlmaLinux:8libzip-tools1.7.3-1.module_el8.10.0+3796+30ed3ef7ALSA-2026:22305
AlmaLinux:8libzip-tools1.6.1-1.module_el8.10.0+3935+28808425ALSA-2026:34354
AlmaLinux:10php8.3.31-1.el10_2ALSA-2026:23388
AlmaLinux:8php7.4.33-4.module_el8.10.0+4209+2ed16ff0ALSA-2026:34354
AlmaLinux:8php8.2.31-1.module_el8.10.0+4189+0784d4ccALSA-2026:22305
AlmaLinux:9php8.0.30-6.el9_8ALSA-2026:33449
AlmaLinux:9php8.2.31-1.module_el9.8.0+254+5708f44cALSA-2026:22143
AlmaLinux:9php8.3.31-2.module_el9.8.0+255+747189f2ALSA-2026:22142
AlmaLinux:10php-bcmath8.3.31-1.el10_2ALSA-2026:23388
AlmaLinux:8php-bcmath8.2.31-1.module_el8.10.0+4189+0784d4ccALSA-2026:22305
AlmaLinux:8php-bcmath7.4.33-4.module_el8.10.0+4209+2ed16ff0ALSA-2026:34354
AlmaLinux:9php-bcmath8.2.31-1.module_el9.8.0+254+5708f44cALSA-2026:22143
AlmaLinux:9php-bcmath8.3.31-2.module_el9.8.0+255+747189f2ALSA-2026:22142
AlmaLinux:9php-bcmath8.0.30-6.el9_8ALSA-2026:33449
AlmaLinux:10php-cli8.3.31-1.el10_2ALSA-2026:23388
AlmaLinux:8php-cli8.2.31-1.module_el8.10.0+4189+0784d4ccALSA-2026:22305
AlmaLinux:8php-cli7.4.33-4.module_el8.10.0+4209+2ed16ff0ALSA-2026:34354
AlmaLinux:9php-cli8.2.31-1.module_el9.8.0+254+5708f44cALSA-2026:22143
AlmaLinux:9php-cli8.0.30-6.el9_8ALSA-2026:33449
AlmaLinux:9php-cli8.3.31-2.module_el9.8.0+255+747189f2ALSA-2026:22142
AlmaLinux:10php-common8.3.31-1.el10_2ALSA-2026:23388
AlmaLinux:8php-common8.2.31-1.module_el8.10.0+4189+0784d4ccALSA-2026:22305
AlmaLinux:8php-common7.4.33-4.module_el8.10.0+4209+2ed16ff0ALSA-2026:34354
AlmaLinux:9php-common8.2.31-1.module_el9.8.0+254+5708f44cALSA-2026:22143
AlmaLinux:9php-common8.3.31-2.module_el9.8.0+255+747189f2ALSA-2026:22142
AlmaLinux:9php-common8.0.30-6.el9_8ALSA-2026:33449
AlmaLinux:10php-dba8.3.31-1.el10_2ALSA-2026:23388
AlmaLinux:8php-dba8.2.31-1.module_el8.10.0+4189+0784d4ccALSA-2026:22305
AlmaLinux:8php-dba7.4.33-4.module_el8.10.0+4209+2ed16ff0ALSA-2026:34354
AlmaLinux:9php-dba8.3.31-2.module_el9.8.0+255+747189f2ALSA-2026:22142
AlmaLinux:9php-dba8.2.31-1.module_el9.8.0+254+5708f44cALSA-2026:22143
AlmaLinux:9php-dba8.0.30-6.el9_8ALSA-2026:33449
AlmaLinux:10php-dbg8.3.31-1.el10_2ALSA-2026:23388
AlmaLinux:8php-dbg8.2.31-1.module_el8.10.0+4189+0784d4ccALSA-2026:22305
AlmaLinux:8php-dbg7.4.33-4.module_el8.10.0+4209+2ed16ff0ALSA-2026:34354
AlmaLinux:9php-dbg8.3.31-2.module_el9.8.0+255+747189f2ALSA-2026:22142
AlmaLinux:9php-dbg8.0.30-6.el9_8ALSA-2026:33449
AlmaLinux:9php-dbg8.2.31-1.module_el9.8.0+254+5708f44cALSA-2026:22143
AlmaLinux:10php-devel8.3.31-1.el10_2ALSA-2026:23388
AlmaLinux:8php-devel8.2.31-1.module_el8.10.0+4189+0784d4ccALSA-2026:22305
AlmaLinux:8php-devel7.4.33-4.module_el8.10.0+4209+2ed16ff0ALSA-2026:34354
AlmaLinux:9php-devel8.3.31-2.module_el9.8.0+255+747189f2ALSA-2026:22142
AlmaLinux:9php-devel8.2.31-1.module_el9.8.0+254+5708f44cALSA-2026:22143
AlmaLinux:9php-devel8.0.30-6.el9_8ALSA-2026:33449
AlmaLinux:10php-embedded8.3.31-1.el10_2ALSA-2026:23388
AlmaLinux:8php-embedded8.2.31-1.module_el8.10.0+4189+0784d4ccALSA-2026:22305
AlmaLinux:8php-embedded7.4.33-4.module_el8.10.0+4209+2ed16ff0ALSA-2026:34354
AlmaLinux:9php-embedded8.0.30-6.el9_8ALSA-2026:33449
AlmaLinux:9php-embedded8.2.31-1.module_el9.8.0+254+5708f44cALSA-2026:22143
AlmaLinux:9php-embedded8.3.31-2.module_el9.8.0+255+747189f2ALSA-2026:22142
AlmaLinux:10php-enchant8.3.31-1.el10_2ALSA-2026:23388
AlmaLinux:8php-enchant7.4.33-4.module_el8.10.0+4209+2ed16ff0ALSA-2026:34354
AlmaLinux:8php-enchant8.2.31-1.module_el8.10.0+4189+0784d4ccALSA-2026:22305
AlmaLinux:9php-enchant8.3.31-2.module_el9.8.0+255+747189f2ALSA-2026:22142
AlmaLinux:9php-enchant8.2.31-1.module_el9.8.0+254+5708f44cALSA-2026:22143
AlmaLinux:9php-enchant8.0.30-6.el9_8ALSA-2026:33449
AlmaLinux:10php-ffi8.3.31-1.el10_2ALSA-2026:23388
AlmaLinux:8php-ffi8.2.31-1.module_el8.10.0+4189+0784d4ccALSA-2026:22305
AlmaLinux:8php-ffi7.4.33-4.module_el8.10.0+4209+2ed16ff0ALSA-2026:34354
AlmaLinux:9php-ffi8.2.31-1.module_el9.8.0+254+5708f44cALSA-2026:22143
AlmaLinux:9php-ffi8.3.31-2.module_el9.8.0+255+747189f2ALSA-2026:22142
AlmaLinux:9php-ffi8.0.30-6.el9_8ALSA-2026:33449
AlmaLinux:10php-fpm8.3.31-1.el10_2ALSA-2026:23388
AlmaLinux:8php-fpm8.2.31-1.module_el8.10.0+4189+0784d4ccALSA-2026:22305
AlmaLinux:8php-fpm7.4.33-4.module_el8.10.0+4209+2ed16ff0ALSA-2026:34354
AlmaLinux:9php-fpm8.0.30-6.el9_8ALSA-2026:33449
AlmaLinux:9php-fpm8.2.31-1.module_el9.8.0+254+5708f44cALSA-2026:22143
AlmaLinux:9php-fpm8.3.31-2.module_el9.8.0+255+747189f2ALSA-2026:22142
AlmaLinux:10php-gd8.3.31-1.el10_2ALSA-2026:23388
AlmaLinux:8php-gd8.2.31-1.module_el8.10.0+4189+0784d4ccALSA-2026:22305
AlmaLinux:8php-gd7.4.33-4.module_el8.10.0+4209+2ed16ff0ALSA-2026:34354
AlmaLinux:9php-gd8.0.30-6.el9_8ALSA-2026:33449
AlmaLinux:9php-gd8.2.31-1.module_el9.8.0+254+5708f44cALSA-2026:22143
AlmaLinux:9php-gd8.3.31-2.module_el9.8.0+255+747189f2ALSA-2026:22142
AlmaLinux:10php-gmp8.3.31-1.el10_2ALSA-2026:23388
AlmaLinux:8php-gmp8.2.31-1.module_el8.10.0+4189+0784d4ccALSA-2026:22305
AlmaLinux:8php-gmp7.4.33-4.module_el8.10.0+4209+2ed16ff0ALSA-2026:34354
AlmaLinux:9php-gmp8.3.31-2.module_el9.8.0+255+747189f2ALSA-2026:22142
AlmaLinux:9php-gmp8.0.30-6.el9_8ALSA-2026:33449
AlmaLinux:9php-gmp8.2.31-1.module_el9.8.0+254+5708f44cALSA-2026:22143
AlmaLinux:10php-intl8.3.31-1.el10_2ALSA-2026:23388
AlmaLinux:8php-intl7.4.33-4.module_el8.10.0+4209+2ed16ff0ALSA-2026:34354
AlmaLinux:8php-intl8.2.31-1.module_el8.10.0+4189+0784d4ccALSA-2026:22305
AlmaLinux:9php-intl8.2.31-1.module_el9.8.0+254+5708f44cALSA-2026:22143
AlmaLinux:9php-intl8.3.31-2.module_el9.8.0+255+747189f2ALSA-2026:22142
AlmaLinux:9php-intl8.0.30-6.el9_8ALSA-2026:33449
AlmaLinux:8php-json7.4.33-4.module_el8.10.0+4209+2ed16ff0ALSA-2026:34354
AlmaLinux:10php-ldap8.3.31-1.el10_2ALSA-2026:23388
AlmaLinux:8php-ldap7.4.33-4.module_el8.10.0+4209+2ed16ff0ALSA-2026:34354
AlmaLinux:8php-ldap8.2.31-1.module_el8.10.0+4189+0784d4ccALSA-2026:22305
AlmaLinux:9php-ldap8.0.30-6.el9_8ALSA-2026:33449
AlmaLinux:9php-ldap8.2.31-1.module_el9.8.0+254+5708f44cALSA-2026:22143
AlmaLinux:9php-ldap8.3.31-2.module_el9.8.0+255+747189f2ALSA-2026:22142
AlmaLinux:10php-mbstring8.3.31-1.el10_2ALSA-2026:23388
AlmaLinux:8php-mbstring7.4.33-4.module_el8.10.0+4209+2ed16ff0ALSA-2026:34354
AlmaLinux:8php-mbstring8.2.31-1.module_el8.10.0+4189+0784d4ccALSA-2026:22305
AlmaLinux:9php-mbstring8.0.30-6.el9_8ALSA-2026:33449
AlmaLinux:9php-mbstring8.3.31-2.module_el9.8.0+255+747189f2ALSA-2026:22142
AlmaLinux:9php-mbstring8.2.31-1.module_el9.8.0+254+5708f44cALSA-2026:22143
AlmaLinux:10php-mysqlnd8.3.31-1.el10_2ALSA-2026:23388
AlmaLinux:8php-mysqlnd7.4.33-4.module_el8.10.0+4209+2ed16ff0ALSA-2026:34354
AlmaLinux:8php-mysqlnd8.2.31-1.module_el8.10.0+4189+0784d4ccALSA-2026:22305
AlmaLinux:9php-mysqlnd8.2.31-1.module_el9.8.0+254+5708f44cALSA-2026:22143
AlmaLinux:9php-mysqlnd8.0.30-6.el9_8ALSA-2026:33449
AlmaLinux:9php-mysqlnd8.3.31-2.module_el9.8.0+255+747189f2ALSA-2026:22142
AlmaLinux:10php-odbc8.3.31-1.el10_2ALSA-2026:23388
AlmaLinux:8php-odbc7.4.33-4.module_el8.10.0+4209+2ed16ff0ALSA-2026:34354
AlmaLinux:8php-odbc8.2.31-1.module_el8.10.0+4189+0784d4ccALSA-2026:22305
AlmaLinux:9php-odbc8.2.31-1.module_el9.8.0+254+5708f44cALSA-2026:22143
AlmaLinux:9php-odbc8.0.30-6.el9_8ALSA-2026:33449
AlmaLinux:9php-odbc8.3.31-2.module_el9.8.0+255+747189f2ALSA-2026:22142
AlmaLinux:10php-opcache8.3.31-1.el10_2ALSA-2026:23388
AlmaLinux:8php-opcache7.4.33-4.module_el8.10.0+4209+2ed16ff0ALSA-2026:34354
AlmaLinux:8php-opcache8.2.31-1.module_el8.10.0+4189+0784d4ccALSA-2026:22305
AlmaLinux:9php-opcache8.2.31-1.module_el9.8.0+254+5708f44cALSA-2026:22143
AlmaLinux:9php-opcache8.3.31-2.module_el9.8.0+255+747189f2ALSA-2026:22142
AlmaLinux:9php-opcache8.0.30-6.el9_8ALSA-2026:33449
AlmaLinux:10php-pdo8.3.31-1.el10_2ALSA-2026:23388
AlmaLinux:8php-pdo7.4.33-4.module_el8.10.0+4209+2ed16ff0ALSA-2026:34354
AlmaLinux:8php-pdo8.2.31-1.module_el8.10.0+4189+0784d4ccALSA-2026:22305
AlmaLinux:9php-pdo8.2.31-1.module_el9.8.0+254+5708f44cALSA-2026:22143
AlmaLinux:9php-pdo8.0.30-6.el9_8ALSA-2026:33449
AlmaLinux:9php-pdo8.3.31-2.module_el9.8.0+255+747189f2ALSA-2026:22142
AlmaLinux:8php-pear1:1.10.14-1.module_el8.10.0+3796+30ed3ef7ALSA-2026:22305
AlmaLinux:8php-pear1:1.10.13-1.module_el8.10.0+3935+28808425ALSA-2026:34354
AlmaLinux:8php-pecl-apcu5.1.23-1.module_el8.10.0+3796+30ed3ef7ALSA-2026:22305
AlmaLinux:8php-pecl-apcu5.1.18-1.module_el8.10.0+3935+28808425ALSA-2026:34354
AlmaLinux:8php-pecl-apcu5.1.18-1.module_el8.6.0+2750+78feabcbALSA-2026:34354
AlmaLinux:9php-pecl-apcu5.1.23-1.module_el9.6.0+151+5f31e576ALSA-2026:22142
AlmaLinux:9php-pecl-apcu5.1.23-1.module_el9.4.0+65+49ff6472ALSA-2026:22143
AlmaLinux:8php-pecl-apcu-devel5.1.23-1.module_el8.10.0+3796+30ed3ef7ALSA-2026:22305
AlmaLinux:8php-pecl-apcu-devel5.1.18-1.module_el8.10.0+3935+28808425ALSA-2026:34354
AlmaLinux:8php-pecl-apcu-devel5.1.18-1.module_el8.6.0+2750+78feabcbALSA-2026:34354
AlmaLinux:9php-pecl-apcu-devel5.1.23-1.module_el9.4.0+65+49ff6472ALSA-2026:22143
AlmaLinux:9php-pecl-apcu-devel5.1.23-1.module_el9.6.0+151+5f31e576ALSA-2026:22142
AlmaLinux:9php-pecl-redis66.1.0-2.module_el9.6.0+151+5f31e576ALSA-2026:22142
AlmaLinux:8php-pecl-rrd2.0.1-1.module_el8.6.0+2750+78feabcbALSA-2026:34354
AlmaLinux:8php-pecl-rrd2.0.1-1.module_el8.10.0+3935+28808425ALSA-2026:34354
AlmaLinux:8php-pecl-rrd2.0.1-1.module_el8.6.0+3239+bedf0508ALSA-2026:34354
AlmaLinux:8php-pecl-rrd2.0.3-1.module_el8.10.0+3796+30ed3ef7ALSA-2026:22305
AlmaLinux:9php-pecl-rrd2.0.3-4.module_el9.4.0+65+49ff6472ALSA-2026:22143
AlmaLinux:9php-pecl-rrd2.0.3-4.module_el9.6.0+151+5f31e576ALSA-2026:22142
AlmaLinux:8php-pecl-xdebug2.9.5-1.module_el8.6.0+2750+78feabcbALSA-2026:34354
AlmaLinux:8php-pecl-xdebug2.9.5-1.module_el8.6.0+3239+bedf0508ALSA-2026:34354
AlmaLinux:8php-pecl-xdebug2.9.5-1.module_el8.10.0+3935+28808425ALSA-2026:34354
AlmaLinux:8php-pecl-xdebug33.2.2-2.module_el8.10.0+3796+30ed3ef7ALSA-2026:22305
AlmaLinux:9php-pecl-xdebug33.3.1-1.module_el9.6.0+151+5f31e576ALSA-2026:22142
AlmaLinux:9php-pecl-xdebug33.2.2-2.module_el9.4.0+65+49ff6472ALSA-2026:22143
AlmaLinux:8php-pecl-zip1.18.2-1.module_el8.6.0+2750+78feabcbALSA-2026:34354
AlmaLinux:8php-pecl-zip1.18.2-1.module_el8.6.0+3239+bedf0508ALSA-2026:34354
AlmaLinux:8php-pecl-zip1.22.3-1.module_el8.10.0+3796+30ed3ef7ALSA-2026:22305
AlmaLinux:8php-pecl-zip1.18.2-1.module_el8.10.0+3935+28808425ALSA-2026:34354
AlmaLinux:9php-pecl-zip1.22.3-1.module_el9.6.0+151+5f31e576ALSA-2026:22142
AlmaLinux:9php-pecl-zip1.22.3-1.module_el9.4.0+65+49ff6472ALSA-2026:22143
AlmaLinux:10php-pgsql8.3.31-1.el10_2ALSA-2026:23388
AlmaLinux:8php-pgsql7.4.33-4.module_el8.10.0+4209+2ed16ff0ALSA-2026:34354
AlmaLinux:8php-pgsql8.2.31-1.module_el8.10.0+4189+0784d4ccALSA-2026:22305
AlmaLinux:9php-pgsql8.0.30-6.el9_8ALSA-2026:33449
AlmaLinux:9php-pgsql8.3.31-2.module_el9.8.0+255+747189f2ALSA-2026:22142
AlmaLinux:9php-pgsql8.2.31-1.module_el9.8.0+254+5708f44cALSA-2026:22143
AlmaLinux:10php-process8.3.31-1.el10_2ALSA-2026:23388
AlmaLinux:8php-process7.4.33-4.module_el8.10.0+4209+2ed16ff0ALSA-2026:34354
AlmaLinux:8php-process8.2.31-1.module_el8.10.0+4189+0784d4ccALSA-2026:22305
AlmaLinux:9php-process8.0.30-6.el9_8ALSA-2026:33449
AlmaLinux:9php-process8.3.31-2.module_el9.8.0+255+747189f2ALSA-2026:22142
AlmaLinux:9php-process8.2.31-1.module_el9.8.0+254+5708f44cALSA-2026:22143
AlmaLinux:10php-snmp8.3.31-1.el10_2ALSA-2026:23388
AlmaLinux:8php-snmp8.2.31-1.module_el8.10.0+4189+0784d4ccALSA-2026:22305
AlmaLinux:8php-snmp7.4.33-4.module_el8.10.0+4209+2ed16ff0ALSA-2026:34354
AlmaLinux:9php-snmp8.2.31-1.module_el9.8.0+254+5708f44cALSA-2026:22143
AlmaLinux:9php-snmp8.0.30-6.el9_8ALSA-2026:33449
AlmaLinux:9php-snmp8.3.31-2.module_el9.8.0+255+747189f2ALSA-2026:22142
AlmaLinux:10php-soap8.3.31-1.el10_2ALSA-2026:23388
AlmaLinux:8php-soap7.4.33-4.module_el8.10.0+4209+2ed16ff0ALSA-2026:34354
AlmaLinux:8php-soap8.2.31-1.module_el8.10.0+4189+0784d4ccALSA-2026:22305
AlmaLinux:9php-soap8.2.31-1.module_el9.8.0+254+5708f44cALSA-2026:22143
AlmaLinux:9php-soap8.3.31-2.module_el9.8.0+255+747189f2ALSA-2026:22142
AlmaLinux:9php-soap8.0.30-6.el9_8ALSA-2026:33449
AlmaLinux:10php-xml8.3.31-1.el10_2ALSA-2026:23388
AlmaLinux:8php-xml8.2.31-1.module_el8.10.0+4189+0784d4ccALSA-2026:22305
AlmaLinux:8php-xml7.4.33-4.module_el8.10.0+4209+2ed16ff0ALSA-2026:34354
AlmaLinux:9php-xml8.2.31-1.module_el9.8.0+254+5708f44cALSA-2026:22143
AlmaLinux:9php-xml8.3.31-2.module_el9.8.0+255+747189f2ALSA-2026:22142
AlmaLinux:9php-xml8.0.30-6.el9_8ALSA-2026:33449
AlmaLinux:8php-xmlrpc7.4.33-4.module_el8.10.0+4209+2ed16ff0ALSA-2026:34354
AlmaLinux:10php8.48.4.21-1.el10_2ALSA-2026:22649
AlmaLinux:10php8.4-bcmath8.4.21-1.el10_2ALSA-2026:22649

Affected products (as reported)

VendorProductVersions
PHP Group PHP 8.2.* – before 8.2.318.3.* – before 8.3.318.4.* – before 8.4.218.5.* – before 8.5.6

Weakness: CWE-190, CWE-125 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References