CVE-2026-7568

Assessment

Why it matters

EPSS is 0.5%; technical severity is CVSS 6.3.

In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the metaphone() function in ext/standard/metaphone.c uses a signed int variable to track the current position within the input string. If a string longer than 2,147,483,647 bytes is passed, a signed integer overflow occurs, resulting in undefined behavior. This can lead to an out-of-bounds read, causing a segmentation fault or access to unrelated memory, and may affect the availability of the PHP process.

Who should care

• Teams operating PHP
• Vulnerability and exposure management teams
• Security operations teams monitoring exploitation activity

Response plan

What I would do

1. Confirm whether PHP is present in the environment.
2. Identify affected versions and establish whether vulnerable services are exposed or reachable.
3. Red Hat Security advisory RHSA-2026:22142
4. Review relevant security telemetry for evidence of attempted or successful exploitation.
5. Document the remediation decision and track it to verified completion.

Technical details

CVSS vector

CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:L/U:Amber

CWE

CWE-125

Affected versions

PHP PHP (Start Including 8.2.0, End Excluding 8.2.31 | Start Including 8.3.0, End Excluding 8.3.31 | Start Including 8.4.0, End Excluding 8.4.21 | Start Including 8.5.0, End Excluding 8.5.6)

Fixed versions

PHP PHP (Fixed from 8.2.31, 8.3.31, 8.4.21, 8.5.6)

Published

10 May 2026

Attack vector

Network

Privileges required

None

User interaction

None

Signal timeline

1. 10 May 2026CVE published
2. 21 Aug 2026Latest EPSS score: 0.5%
3. 19 Aug 2026 · 13:52 UTCSignal calculated at 11

External references

• GitHub Technical reference GHSA 96wq 48vp Hh57 ↗