CVE-2026-17545 PHP Group CVE debrief

Who should care

Defenders responsible for PHP installations on Windows systems, especially those handling file operations, should assess exposure and prioritize verification and patching. This includes operators, platform administrators, vulnerability management teams, and security teams who need to review and implement necessary security measures to mitigate potential risks.

Why it matters

CVE-2026-17545 is a medium-severity vulnerability in PHP's filesystem and stream APIs on Windows. Defenders should prioritize verifying and patching affected installations, especially those handling file operations, to mitigate potential risks.

• Potential blocking or hanging of requests due to device opening instead of regular file access.
• Exhaustion of worker processes due to repeated exploitation attempts.
• Need for verification of affected versions and remediation efforts.
• Potential impact on system availability and performance.

Technical summary

The vulnerability occurs because PHP's filesystem and stream APIs on Windows do not reject reserved device names when they appear as a component of a path. This allows an attacker-controlled filename to reach CreateFileW() and open a device instead of the regular file the application expected, potentially blocking or hanging the request and exhausting worker processes. The affected product context includes PHP installations on Windows systems, particularly those handling file operations. Defenders should prioritize verifying and patching affected installations to mitigate potential risks.

Defensive priority

Defenders should prioritize verifying and patching affected PHP installations, especially those handling file operations on Windows systems.

Recommended defensive actions

• Verify and patch affected PHP installations, especially those handling file operations on Windows systems.
• Monitor and limit exposure to potential attacks on Windows systems using PHP.
• Implement additional security measures, such as input validation and access controls, to mitigate potential risks.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and NVD entry provide limited information about the vulnerability. Further investigation and verification are necessary to determine the full scope of the vulnerability and potential impact.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.