PT-2026-39457 · Php · Php

Akshay Jain + 1 · Published 2026-05-10 · Updated 2026-05-10 · CVE-2026-6104

NVD

CVSS v4.0

6.3

Medium

Base vector

AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:L/SC:L/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:M/U:Amber

In PHP versions 8.4.* before 8.4.21 and 8.5.* before 8.5.6, when an encoding name containing an embedded NUL byte is passed to mb convert encoding() or related mbstring functions, the code incorrectly assumes that when strncasecmp() returns 0 it means the strings have the same length. This can lead to out-of-bounds read of global memory, potentially causing a crash or information disclosure or crash. Affected functions include mb convert encoding(), mb detect encoding(), mb convert variables(), and mb detect order(), as well as the mbstring.detect order and mbstring.http output INI settings.

Fix

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

CVE-2026-6104

Affected Products

Php

References · 2

• https://github.com/php/php-src/security/advisories/GHSA-74r9-qxhc-fx53 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-6104 · Security Note