CVE-2016-4538: The bcpowmod function in ext/bcmath/bcmath.c in PHP before 5.5.35, 5.6.x before 5.6.21, and 7.x before 7.0....

Security readout for executives and security teams

CVE-2016-4538 affects older PHP releases. A crafted use of PHP’s bcpowmod function can corrupt shared internal values and crash the process, causing denial of service. The sources also mention possible unspecified other impact, but do not substantiate code execution or active exploitation. Exposure is most likely on legacy PHP 5.5, 5.6, or early 7.0 systems with bcmath enabled and application code that can invoke bcpowmod using attacker-influenced input. Prioritize remediation where old PHP powers public-facing applications. This is mainly a service-availability risk, but unsupported PHP also carries broader operational exposure. Upgrade during normal security maintenance unless the affected function is reachable from untrusted users. Mitigation focus: Upgrade PHP to 5.5.35, 5.6.21, 7.0.6, or later supported releases.; Apply distribution vendor updates from Debian, Red Hat, openSUSE, Gentoo, or relevant platform maintainers.; Identify legacy applications using PHP bcmath and prioritize externally reachable services..

Prepared

Jun 13, 2026, 14:22 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.