CVE-2016-4540: The grapheme_stripos function in ext/intl/grapheme/grapheme_string.c in PHP before 5.5.35, 5.6.x before 5.6...

Security readout for executives and security teams

A bug in PHP’s internationalization grapheme_stripos function can let a remote attacker trigger an out-of-bounds read with a negative offset. The documented impact is denial of service, with possible unspecified other impact not further defined. It affects old PHP branches before 5.5.35, 5.6.21, and 7.0.6. Exposure is most likely in legacy PHP applications using vulnerable PHP 5.5, 5.6, or 7.0 runtimes with the intl extension and code paths that process untrusted input through grapheme_stripos. Treat as a legacy-platform risk. It is not KEV-listed in the bundle, but internet-facing PHP services on obsolete runtimes should be remediated because reliable denial of service can still disrupt operations. Mitigation focus: Upgrade PHP to 5.5.35, 5.6.21, 7.0.6, or later supported vendor packages.; Apply relevant distribution security updates from Debian, Red Hat, openSUSE, Gentoo, Fedora, or HPE as applicable.; Prioritize replacement of end-of-life PHP branches with supported runtimes..

Prepared

Jun 13, 2026, 14:22 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.