Attacker‑supplied data to the bccomp() function in PHP can trigger an out‑of‑bounds write, causing corruption of both stack and heap memory. This memory corruption could result in arbitrary code execution by an attacker who is able to supply crafted operands and scale values to bccomp(). The vulnerability is identified as a buffer overrun (CWE‑787) and is ranked as high severity.

The flaw affects PHP version 8.4.x prior to 8.4.24 and PHP version 8.5.x prior to 8.5.9. Systems running these PHP releases with any code paths that invoke bccomp() are potentially vulnerable; PHP Group:PHP is the affected vendor.

The CVSS score of 8.1 indicates a high impact, and the EPSS score of < 1% indicates a low probability of exploitation, while the absence of a KEV listing does not reduce the likelihood of exploitation. Given that bccomp() accepts attacker‑controlled input, the likely attack vector is remote and can be exercised via web applications or services that use bccomp(). An attacker who can supply the proper inputs can exploit the vulnerability to corrupt memory, potentially leading to arbitrary code execution on the affected host.