CVE-2016-4537: The bcpowmod function in ext/bcmath/bcmath.c in PHP before 5.5.35, 5.6.x before 5.6.21, and 7.x before 7.0....

Security readout for executives and security teams

This is a PHP bcmath flaw where certain PHP versions mishandle a negative scale value in bcpowmod. An attacker could cause denial of service if an application lets them reach that function with crafted input. Sources do not show active exploitation, and the broader impact is not well defined. Exposure is likely limited to systems running affected PHP versions with the bcmath extension and application paths that call bcpowmod using attacker-influenced input. The provided data does not prove exposure in all PHP deployments or identify affected third-party applications. Treat as a maintenance-priority denial-of-service risk for legacy PHP estates. It is not supported as actively exploited by the supplied evidence, but affected PHP branches are old and should be removed or patched through vendor-supported packages. Mitigation focus: Upgrade PHP to 5.5.35, 5.6.21, 7.0.6, or later supported releases.; Apply fixed distribution packages from Debian, Red Hat, SUSE, Gentoo, Fedora, or relevant vendor advisories.; Identify applications using bcmath bcpowmod with user-controlled numeric inputs..

Prepared

Jun 13, 2026, 14:22 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.