CVE-2026-7568

score

<0.1

cvss

7.5

epss

0.8%

published

2026-05-10

kev added

—

first seen

2026-10-21

PHP 8.2.* < 8.2.31, 8.3.* < 8.3.31, 8.4.* < 8.4.21, and 8.5.* < 8.5.6 contain an out-of-bounds read caused by signed integer overflow in metaphone() function in ext/standard/metaphone.c, letting attackers cause segmentation fault or memory access, exploit requires passing extremely long string.