PHP bcmath bccomp() Out-of-Bounds Write (CVE-2026-17544)

CVE-2026-17544 is an out-of-bounds write vulnerability in the PHP bcmath extension, specifically in the bc_str2num() function in ext/bcmath/libbcmath/src/str2num.c. When the manual scale is smaller than the auto scale, the fraction is truncated and a trailing-zero trim runs, but the fractional_end pointer is not updated. The subsequent bc_new_num_nonzeroed() allocates a buffer sized for the trimmed number, but bc_copy_and_toggle_bcd() copies the untrimmed length, causing a stack buffer overflow.

The trigger PoC calls bccomp() with a crafted number containing trailing zeros that cause the length mismatch. On vulnerable builds, this results in a stack smashing detection (SIGABRT). In a weaponized scenario, this could lead to arbitrary code execution.

Root Cause

In bc_str2num(), after truncating the fraction to match the manual scale and trimming trailing zeros, str_scale is decremented but fractional_end is not updated. The allocation uses the shorter str_scale but the copy uses the original (longer) fractional range, writing past the allocated buffer.

Attack Flow

1. Trigger: Call bccomp() (or bcadd/bcsub/bcmul/bcdiv) with a number like “1.9” followed by 300 zeros and “1”, with scale=300
2. Overflow: The trailing-zero trim shortens the allocated buffer but the copy writes the full untrimmed length
3. Impact: Stack buffer overflow leading to stack canary corruption (SIGABRT) or potential RCE