PHP Out-of-bounds Read Vulnerability - CVE-2026-7568

In PHP versions 8.2. before 8.2.31 8.3. before 8.3.31 8.4. before 8.4.21 and 8.5. before 8.5.6 the metaphone() function in ext/standard/metaphone.c uses a signed int variable to track the current position within the input string. If a string longer than 2147483647 bytes is passed a signed integer overflow occurs resulting in undefined behavior. This can lead to an out-of-bounds read causing a segmentation fault or access to unrelated memory and may affect the availability of the PHP process.