PT-2026-39447 · Php · Php

Amirmohammad Pasdar + 5 · Published 2026-05-10 · Updated 2026-05-10 · CVE-2026-7259

Mitre

CVSS v4.0

2.1

Low

Base vector

AV:N/AC:H/AT:P/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L/AU:Y/U:Amber

In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, a mismatch between encoding lists in Oniguruma and mbfl leads to  a NULL pointer dereference, resulting in a segmentation fault and denial of service. The vulnerability is exploitable when user-controlled input can influence the encoding passed to mb regex encoding().

Fix

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

CVE-2026-7259

Affected Products

Php

References · 2

• https://github.com/php/php-src/security/advisories/GHSA-wm6j-2649-pv75 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-7259 · Security Note