If you take away the call to `system` what are you left with?<p>It's not so much a vulnerability, but certainly a bug and I agree, it needs fixing. But it doesn't feel particularly urgent.<p>It would likely be classed as a vulnerability if the out of bounds access _itself_ exposed some kind of internal issue beyond accessing the user input data in an unusual manner.<p>It only becomes a vulnerability in userland code where it's in the hands of a naive implementation, such as the one posited here.<p>The other factor is that, as noted by others, there are likely a number of other layers that a sysadmin can put into place using readily-available PHP config options that would essentially prevent this from being possible and by default are pre-configured in such a way to prevent this.<p>Would be interesting to see if there is code in the wild that is as naive as the example given, but my gut says 'probably not' so again likelihood of this being an issue is very very low.<p>From that perspective I can understand core PHP devs opting not to pursue this immediately.