Sploitus

Exploit for Out-of-bounds Write in Php

CVE-2026-17544

githubexploit · 2026-08-12

Exploit Code

README35 lines
## https://sploitus.com/exploit?id=CB29ED0B-1320-5F88-A5A1-857A4CB9F1DA
# CVE-2026-17544 — PHP bcmath `bccomp()` Out-of-Bounds Write (Stack Smashing)

**CVSS 9.8 (Critical)** · CWE-787 · GHSA-x692-q9x7-8c3f

## Summary

`bc_str2num()` in `ext/bcmath/libbcmath/src/str2num.c` (vendored libbcmath, PHP 8.4+) contains an
off-by-N out-of-bounds write. When the user-supplied `scale` is smaller than the operand's auto
scale, the fraction is truncated and then a trailing-zero trim runs **without updating
`fractional_end`**. The buffer is allocated for the trimmed (shorter) length but the copy uses the
untrimmed length → heap/stack buffer overflow.

**Affected:** PHP 8.4.\* /dev/null 2>&1 && php trigger.php'
# -> stack smashing detected (exit 133)

# Patched PHP:
docker run --rm -v "$PWD":/app -w /app php:8.4.24-cli sh -c \
  'docker-php-ext-install bcmath >/dev/null 2>&1 && php trigger.php'
# -> int(1), exit 0
```

## Impact

- **Remote DoS:** any service passing attacker-controlled operands/scale to `bccomp()` can be
  crashed deterministically (8.4/8.5, stack-protector builds abort; non-protected builds corrupt
  saved registers/return address).
- **RCE:** theoretically possible via heap grooming, but the OOB bytes are limited to BCD values
  (0x00–0x09) and overflow size = number of trimmed zeros — hard, not demonstrated.

## References

- GHSA: https://github.com/php/php-src/security/advisories/GHSA-x692-q9x7-8c3f
- NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-17544
- Fix 8.4: `fa18dab73f93` · Fix 8.5: `ce2ec8a70755`