CVE-2016-4541: The grapheme_strpos function in ext/intl/grapheme/grapheme_string.c in PHP before 5.5.35, 5.6.x before 5.6....

Security readout for executives and security teams

CVE-2016-4541 is a PHP bug in grapheme_strpos. In affected PHP versions, a negative offset can trigger an out-of-bounds read, causing denial of service and possibly other unspecified impact. Business urgency depends on whether exposed applications use PHP's intl grapheme functions with user-controlled input. Exposure is most plausible on legacy PHP systems running vulnerable versions with the intl extension enabled, especially public web applications that pass user-controlled offsets or strings into grapheme_strpos. Bundled PHP in vendor products may also matter if covered by their advisories. Prioritize remediation where legacy PHP supports public-facing applications or vendor products. This is mainly a service-availability risk from the supplied evidence, with uncertain additional impact. It should be folded into legacy PHP upgrade work rather than treated as confirmed emergency exploitation. Mitigation focus: Upgrade PHP to 5.5.35, 5.6.21, 7.0.6, or a later supported release.; Apply relevant vendor security updates for Debian, Red Hat, openSUSE, Fedora, Gentoo, or affected providers.; Retire unsupported PHP 5.x and 7.0 deployments where patch status cannot be verified..

Prepared

Jun 13, 2026, 14:22 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.