VIR Vulnerability Intelligence Relay

CVE-2026-7568

high
Published 2026-05-10 · Modified 2026-06-01
💬 Discuss on Community ✚ Propose mitigation
CVSS v3
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4 NEW
6.3
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:L/U:Amber
VIR risk
7.5

Description

Important: php:8.2 security update

Predictions

Exploit likelihood
83%
Patch ETA
—

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

Mitigation details

Source: Red Hat Errata — Red Hat Inc. · View original ↗ · Open-Errata-API

Description php: signed integer overflow in metaphone() Red Hat statement This issue can be exploited by passing an excessively large string, exceeding 2,147,483,647 bytes, to the metaphone() function. This function is used for searching and matching words based on their phonetic sound. The large string can lead to a signed integer overflow that allows an attacker to cause an out-of-bounds read,…

Description

php: signed integer overflow in metaphone()

Red Hat statement

This issue can be exploited by passing an excessively large string, exceeding 2,147,483,647 bytes, to the metaphone() function. This function is used for searching and matching words based on their phonetic sound. The large string can lead to a signed integer overflow that allows an attacker to cause an out-of-bounds read, resulting in a denial of service. Due to these reasons, this vulnerability has been rated with an important severity.

CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Errata / fixed releases

ProductPackageAdvisoryReleased
Red Hat Enterprise Linux 8php:8.2-8100020260521052503.f7998665RHSA-2026:223052026-06-01T00:00:00Z
Red Hat Enterprise Linux 9php:8.3-9080020260521113736.9RHSA-2026:221422026-06-01T00:00:00Z
Red Hat Enterprise Linux 9php:8.2-9080020260521080715.9RHSA-2026:221432026-06-01T00:00:00Z

Package state

ProductPackageState
Red Hat Enterprise Linux 10phpAffected
Red Hat Enterprise Linux 10php8.4Affected
Red Hat Enterprise Linux 6phpNot affected
Red Hat Enterprise Linux 7phpNot affected
Red Hat Enterprise Linux 8php:7.4/phpNot affected
Red Hat Enterprise Linux 9phpNot affected
Red Hat Hardened ImagesphpNot affected

Apply commands

bash fix
Apply RHSA-2026:22305 for Red Hat Enterprise Linux 8
yum update -y php:8
# or:
dnf upgrade -y php:8

Affected

VendorProductVersion
redhatRed Hat Enterprise Linux 10Affected
redhatRed Hat Enterprise Linux 10Affected
redhatRed Hat Enterprise Linux 6Not affected
redhatRed Hat Enterprise Linux 7Not affected
redhatRed Hat Enterprise Linux 8Not affected
redhatRed Hat Enterprise Linux 9Not affected
redhatRed Hat Hardened ImagesNot affected

OS impact
suse SUSE Affected 1 release
VersionStatusFixed in
— Affected —
windows Windows Affected 1 release
VersionStatusFixed in
— Affected —
almalinux AlmaLinux Fixed 2 releases
VersionStatusFixed in
9 Fixed apcu-panel-5.1.23-1.module_el9.6.0+151+5f31e576.noarch.rpm
8 Fixed apcu-panel-5.1.23-1.module_el8.10.0+3796+30ed3ef7.noarch.rpm
debian Debian Fixed 5 releases
VersionStatusFixed in
trixie Fixed 8.4.21-1~deb13u1
sid Fixed 8.4.21-1
forky Fixed 8.4.21-1
bullseye Fixed 7.4.33-1+deb11u11
bookworm Fixed 8.2.31-1~deb12u1
redhat Red Hat Fixed 2 releases
VersionStatusFixed in
9 Fixed —
8 Fixed —

Application impact
VendorProductVersionsFixed
php phpphp{"startIncluding":"8.2.0","endExcluding":"8.2.31"}8.2.31

References

CWEs

CWE-125 CWE-190

Community-verified mitigations for this CVE will appear above when contributors publish them.

Verify integrity in audit chain (admin only). AS-IS.