CVE-2016-4344: Integer overflow in the xml_utf8_encode function in ext/xml/xml.c in PHP before 7.0.4 allows remote attacke...

Security readout for executives and security teams

This flaw is in PHP's XML-related UTF-8 encoding code before PHP 7.0.4. A very long input to utf8_encode could trigger memory corruption, causing a crash and possibly other unspecified impact. Business urgency depends on whether legacy PHP runtimes still process attacker-controlled input through this function. Exposure is most likely in legacy PHP deployments older than 7.0.4 where application code passes user-controlled long strings to utf8_encode. The source bundle does not provide CPEs, affected distributions, or complete product inventory details. Treat this as a legacy platform cleanup issue with service-availability risk. It is not KEV-listed in the supplied data, but vulnerable PHP before 7.0.4 is far outside normal support expectations and should not remain on exposed systems. Mitigation focus: Upgrade PHP to 7.0.4 or later, or a vendor build with the backported fix.; Check PHP vendor or distribution advisories for supported package versions.; Prioritize retiring unsupported PHP 7.0-era runtimes from internet-facing services..

Prepared

Jun 13, 2026, 14:22 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.