CVE-2026-6104

Name of the Vulnerable Software and Affected Versions PHP versions 8.4.0 through 8.4.20 PHP versions 8.5.0 through 8.5.5

Description An issue exists in the mbstring extension where passing an encoding name containing an embedded NUL byte to certain functions causes the code to incorrectly assume strings are of equal length when strncasecmp() returns 0. This can result in an out-of-bounds read of global memory, which may lead to information disclosure or a system crash. Affected functions include mb convert encoding(), mb detect encoding(), mb convert variables(), and mb detect order(). Additionally, the mbstring.detect order and mbstring.http output INI settings are affected.

Recommendations Update PHP version 8.4.x to 8.4.21. Update PHP version 8.5.x to 8.5.6.