CVE-2016-4346: Integer overflow in the str_pad function in ext/standard/string.c in PHP before 7.0.4 allows remote attacke...

Security readout for executives and security teams

CVE-2016-4346 is a PHP core bug in str_pad. A very large input can trigger an integer overflow that may crash a PHP process and may have other unspecified effects. The public bundle identifies PHP before 7.0.4, but does not provide CVSS, CWE, or broad product mapping. Exposure is most likely where PHP before 7.0.4, or unconfirmed backported builds, process attacker-controlled values through str_pad. Internet-facing PHP applications increase relevance, but the bundle does not identify specific applications or distributions beyond openSUSE advisories. Treat as a maintenance-priority server-side risk. It is not confirmed exploited here, but outdated PHP runtimes create avoidable availability and memory-safety exposure, especially on public web services. Mitigation focus: Upgrade PHP to 7.0.4 or a vendor-supported fixed backport.; Apply relevant openSUSE security updates where those packages are used.; Check current PHP and operating-system vendor guidance for supported fix status..

Prepared

Jun 13, 2026, 14:22 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.