EIP-2026-104660

PRE-CVE

PHP 5.3.3 - 'ibase_gen_id()' Off-by-One Overflow

Title source: legacy
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for EIP-2026-104660. PoCs published by Canberk BOLAT.

AI-analyzed exploit summary The writeup details an off-by-one buffer overflow vulnerability in PHP's ibase_gen_id() function, where user-supplied input is copied into a fixed-size buffer without proper bounds checking. The patch involves adjusting the snprintf call to prevent overflow.

Description

PHP 5.3.3 - 'ibase_gen_id()' Off-by-One Overflow

Exploits (1)

exploitdb WRITEUP
by Canberk BOLAT · textdosphp
https://www.exploit-db.com/exploits/14678

The writeup details an off-by-one buffer overflow vulnerability in PHP's ibase_gen_id() function, where user-supplied input is copied into a fixed-size buffer without proper bounds checking. The patch involves adjusting the snprintf call to prevent overflow.

Classification
Writeup 90%
Attack Type
Dos
Complexity
Moderate
Reliability
Theoretical
Target: PHP 5.3.3 (possibly all versions)
No auth needed
Prerequisites: PHP with InterBase/Firebird support enabled
devstral-2 · analyzed Feb 18, 2026 Full analysis →

Details

Status pre_cve
Tracked Since Feb 18, 2026